lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 24 Oct 2007 22:46:58 +0200 (CEST) From: Jan Engelhardt <jengelh@...putergmbh.de> To: Crispin Cowan <crispin@...spincowan.com> cc: Simon Arlott <simon@...e.lp0.eu>, Adrian Bunk <bunk@...nel.org>, Chris Wright <chrisw@...s-sol.org>, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org, Linus Torvalds <torvalds@...ux-foundation.org>, Andreas Gruenbacher <agruen@...e.de>, Thomas Fricaccia <thomas_fricacci@...oo.com>, Jeremy Fitzhardinge <jeremy@...p.org>, James Morris <jmorris@...ei.org>, Giacomo Catenazzi <cate@...ian.org>, Alan Cox <alan@...rguk.ukuu.org.uk> Subject: Re: Linux Security *Module* Framework (Was: LSM conversion to static interface) On Oct 24 2007 13:18, Crispin Cowan wrote: >Jan Engelhardt wrote: >> On Oct 24 2007 19:11, Simon Arlott wrote: >> >>> * (I've got a list of access rules which are scanned in order until one of >>> them matches, and an array of one bit for every port for per-port default >>> allow/deny - although the latter could be removed. >>> http://svn.lp0.eu/simon/portac/trunk/) >>> >> Besides the 'feature' of inhibiting port binding, >> is not this task of blocking connections something for a firewall? >> >So now you are criticizing his module. Arguing about the merits of >security semantics. This is exactly why Linus wanted LSM, so we don't >have to have these kinds of discussions, at least not on LKML :) This was a question. I was perfectly aware that iptables alone does not prohibit binding, and there are reasons to inhibit binding. But sometimes, a coder does not know where to start - chances are, that someone else wanting to do bind(2) inhibiting is doing it with a syscall table change. Or coder did not notice that a firewall is sufficient for the task to be achieved (which is not always the case - hence the question). - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists