lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4707DE96.4090400@tmr.com> Date: Sat, 06 Oct 2007 15:14:30 -0400 From: Bill Davidsen <davidsen@....com> To: Kyle Moffett <mrmacman_g4@....com> CC: "Eric W. Biederman" <ebiederm@...ssion.com>, Linus Torvalds <torvalds@...ux-foundation.org>, Stephen Smalley <sds@...ho.nsa.gov>, James Morris <jmorris@...ei.org>, Andrew Morton <akpm@...ux-foundation.org>, casey@...aufler-ca.com, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, "Serge E. Hallyn" <serge@...lyn.com> Subject: Re: [PATCH] Version 3 (2.6.23-rc8) Smack: Simplified Mandatory Access Control Kernel Kyle Moffett wrote: > On Oct 04, 2007, at 21:44:02, Eric W. Biederman wrote: >> What we want from the LSM is the ability to say -EPERM when we can >> clearly articulate that we want to disallow something. > > This sort of depends on perspective; typically with security > infrastructure you actually want "... the ability to return success when > we can clearly articulate that we want to *ALLOW* something". File > permissions work this way; we don't have a list of forbidden users > attached to each file, we have an owner, a group, and a mode > representing positive permissions. With that said in certain high-risk > environments you need something even stronger that cannot be changed by > the "owner" of the file, if we don't entirely trust them, > Other than ACLs, of course, which do allow blacklisting individual users. -- Bill Davidsen <davidsen@....com> "We have more to fear from the bungling of the incompetent than from the machinations of the wicked." - from Slashdot - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists