linux-kernel - Re: Out of tree module using LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4750A225.3060505@crispincowan.com>
Date:	Fri, 30 Nov 2007 15:52:05 -0800
From:	Crispin Cowan <crispin@...spincowan.com>
To:	James Morris <jmorris@...ei.org>
CC:	"Tvrtko A. Ursulin" <tvrtko.ursulin@...hos.com>,
	linux-kernel@...r.kernel.org,
	LSM ML <linux-security-module@...r.kernel.org>
Subject: Re: Out of tree module using LSM

James Morris wrote:
> On Fri, 30 Nov 2007, Crispin Cowan wrote:
>> restored faces a lot of challenges, but I hope that some kind of
>> solution can be found, because the alternative is to effectively force
>> vendors like Sophos to do it the "dirty" way by fishing in memory for
>> the syscall table.
>>     
> I don't think this is quite correct.
>
> The alternative is to engage with the kernel community to become part of 
> the development process, to ensure that appropriate APIs are implemented, 
> and to get code upstream before shipping it.
>   
That would be part of the "some kind of solution can be found" so I
think we are in agreement here.

> In any case, a patch to revert the dynamic aspect of LSM has been posted 
> by Arjan (and acked by myself) for the case of valid out of tree users.  
> The only case of this so far has been Multiadm, although there seems to be 
> no reason for it to stay out of tree.
>   
Dazuko. It has the same yucky code issues as Talpa, but AFAIK is pure
GPL2 and thus is clean on the license issues.

That these modules are valid modules that users want to use, are GPL
clean, and are *not* something LKML wants to upstream because of code
issues, is precisely why the LSM interface makes sense.

Crispin

-- 
Crispin Cowan, Ph.D.               http://crispincowan.com/~crispin
CEO, Mercenary Linux		   http://mercenarylinux.com/
	       Itanium. Vista. GPLv3. Complexity at work

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/