linux-kernel - Re: Out of tree module using LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071129005841.GA11860@kroah.com>
Date:	Wed, 28 Nov 2007 16:58:41 -0800
From:	Greg KH <greg@...ah.com>
To:	"Tvrtko A. Ursulin" <tvrtko.ursulin@...hos.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Out of tree module using LSM

On Wed, Nov 28, 2007 at 12:42:52PM +0000, Tvrtko A. Ursulin wrote:
> 
> Hi Linus, all,
> 
> During one recent LKML discussion 
> (http://marc.info/?l=linux-kernel&m=119267398722085&w=2) about LSM going 
> static  you called for LSM users to speak up.
> 
> We here at Sophos (the fourth largest endpoint security vendor in the world) 
> have such a module called Talpa which is a part of our main endpoint security 
> product for Linux  that protects from viruses and malware hosted on Linux, 
> including those targetting Windows or other connected devices,  
> (http://www.sophos.com/products/enterprise/endpoint/security-and-control/linux/index.html) 
> which is GPL code and has been in the field for almost three years now. It's 
> source code has been shipping with the product from the start.  We also have 
> a SourceForge project at http://sourceforge.net/projects/talpa/ to host it.
> 
> In essence, what our module does is it intercepts file accesses and allows 
> userspace daemons to vet them. One of the means we implemented that is 
> through LSM and although it is not a perfect match for such use we prefer to 
> use an official interface. Unfortunately, with time it became impossible to 
> use LSM on some distributions (SELinux) so we had to implement other 
> intercept methods which are significantly less nice, and which may also 
> become unworkable over time.

Do you have a patch that shows the type of interface you would like to
see?  Like James stated, if you do not participate in the development
process, we have no way of knowing what you even want from the kernel.

What has kept you from submitting your code for inclusion in the main
kernel source tree?

Right now, your customers void their support warranties if they run your
software, as it can not be supported by the distros as an out-of-tree
kernel module.  I'm sure your customers would like to not have this
problem.

thanks,

greg k-h
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/