linux-kernel - Re: [PATCH try #3] security: Convert LSM into a static interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1184864070.2694.3.camel@laptopd505.fenrus.org>
Date:	Thu, 19 Jul 2007 09:54:30 -0700
From:	Arjan van de Ven <arjan@...radead.org>
To:	"Serge E. Hallyn" <serge@...lyn.com>
Cc:	Christian Ehrhardt <lk@...e.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	James Morris <jmorris@...ei.org>,
	Chris Wright <chrisw@...s-sol.org>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Stephen Smalley <sds@...ho.nsa.gov>,
	"Serge E. Hallyn" <serue@...ibm.com>
Subject: Re: [PATCH try #3] security: Convert LSM into a static interface

> Right, the ability to boot with security.capability=disabpled (or
> whatever) and then load a custom module without having to use a whole
> new kernel is something I'm sure end-users want.
> 
> Especially since compiling a kernel which works with, say, a default
> fedora install, with lvm etc, is not imo for a novice (where novice
> != security novice).

the next step after this patch is to have an option to get rid of all
the function pointer chasing (which is expensive) for the case where you
know you only want one security module (which you then can turn on or
off)... that advantage is a performance gain for a lot of people.... but
if the person configuring the kernel selects this, it does mean there's
no way to load modules. I don't know what Fedora will do, but they might
select such an option. That's CHOICE... they chose a performance
improvement over enabling external kernel modules that they don't ship
anyway...

but is it really worth blocking such clear improvements in performance?

-- 
if you want to mail me at work (you don't), use arjan (at) linux.intel.com
Test the interaction between Linux and your BIOS via http://www.linuxfirmwarekit.org

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/