linux-kernel - Re: [PATCH try #3] security: Convert LSM into a static interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Jul 2007 20:35:38 -0700 (PDT)
From:	david@...g.hm
To:	James Morris <jmorris@...ei.org>
cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Chris Wright <chrisw@...s-sol.org>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Stephen Smalley <sds@...ho.nsa.gov>,
	"Serge E. Hallyn" <serue@...ibm.com>,
	Arjan van de Ven <arjan@...radead.org>
Subject: Re: [PATCH try #3] security: Convert LSM into a static interface

On Wed, 18 Jul 2007, James Morris wrote:

> 
> On Wed, 18 Jul 2007, Andrew Morton wrote:
>
>>> The SECURITY_FRAMEWORK_VERSION macro has also been removed.
>>
>> I'd like to understand who is (or claims to be) adversely affected by this
>> change, and what their complaints (if any) will be.
>>
>> Because I prefer my flamewars pre- rather than post-merge.
>
> This was already discussed and resolved during previous postings of the
> patch.
>
> In a nutshell, there is no safe way to unload an LSM.  The modular
> interface is thus unecessary and broken infrastructure.  It is used only
> by out-of-tree modules, which are often binary-only, illegal, abusive of
> the API and dangerous, e.g. silently re-vectoring SELinux.

there's a difference between 'often' and 'always'. I really don't think 
you want to start that sort of argument (after all, would you like it if 
the MPAA argued "dvd burners are often used to make pirate copies, let's 
make it so that they won't burn anything without being given a special 
key"?)

and arguing that the LSM is only used by out-of-tree modules and then 
strenuously opposing mergeing of such modules means that one of your 
arguments is bogus

David Lang

> Chris has already agreed to take the patch:
> http://lkml.org/lkml/2007/6/24/152
>
>
>> aww man, you passed over an opportunity to fix vast amounts of coding style
>> cruftiness.
>
> GregKH-esque :-)
>
>> <does whizzy things>
>>
>> Here you go..
>
> Thanks.
>
>
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/