linux-kernel - Re: LSM conversion to static interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071022181220.7a9b4ab9@the-village.bc.nu>
Date:	Mon, 22 Oct 2007 18:12:20 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	"Thomas Fricaccia" <thomas_fricacci@...oo.com>
Cc:	linux-kernel@...r.kernel.org,
	"Linus Torvalds" <torvalds@...ux-foundation.org>,
	Greg KH <greg@...ah.com>,
	LSM ML <linux-security-module@...r.kernel.org>,
	Crispin Cowan <crispin@...spincowan.com>
Subject: Re: LSM conversion to static interface

> The point of contention:  closing LSM significantly reduces the freedom
> of an important class of Linux users, the commercial enterprises, to
> use whatever security framework they desire.  Greg and Alan didn't

No it doesn't. Strange interpretations of peculiar US laws may be doing
that. Thats [with Linux community hat on] _not_our_problem_.

> Why can't a CONFIG_ system be developed that can give everyone pretty
> much what he wants?  It should be possible to develop a system
> permitting much flexibility wrt security frameworks:
>  1.  a kernel configured with statically-linked hooks into exactly
>       one framework.
>                      --- OR ---
>  2.  a kernel configured with an in-tree framework, but which uses
>       an LSM "security_operations" table.  (This is what we pretty much
>       have in 2.6.23).  In addition, a new boot parameter could let the
>       end user name the framework to use, which would completely
>       replace the in-tree default framework at boot time.

Send patches.

> In the same note, he agreed with Alan that "SarBox is not really the issue
> here."  Well, I'm pretty certain that regulatory law strongly shapes
> market forces and enterprise needs.  In particular, I've heard several
> times that enterprises users  really want to just BUY all their security
> products, and that these products must be accompanied by documentation for
> any audits.  So, I'm pretty sure that if it is "not ... the issue", it
> strongly influences the issue.

Corporations practice "liability dumping" so that would be expected. They
want to dumb liability onto their suppliers, their customers and anyone
else they can find. Its the logical commercial practice faced by any
rational body evolving in the US marketplace.

But thats still their issue, no the community's issue. 

Alan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/