linux-kernel - Re: [PATCH 01/11] Security: Add hook to get full maclabel xattr name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <271809.19457.qm@web36609.mail.mud.yahoo.com>
Date:	Fri, 29 Feb 2008 14:58:36 -0800 (PST)
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Dave Quigley <dpquigl@...ho.nsa.gov>, casey@...aufler-ca.com
Cc:	Trond Myklebust <trond.myklebust@....uio.no>,
	Christoph Hellwig <hch@...radead.org>,
	Stephen Smalley <sds@...ho.nsa.gov>, viro@....linux.org.uk,
	bfields@...ldses.org, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org,
	LSM List <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH 01/11] Security: Add hook to get full maclabel xattr name

--- Dave Quigley <dpquigl@...ho.nsa.gov> wrote:

> 
> ...
> 
> You need to give me a specific example of why if I have policy A on both
> ends on an SELinux box that a secctx isn't the same on both boxes. 

Trond can, and I'm completely confident he will, correct me if I'm
wrong, but interoperability seems to require that you can't assume
the perfect administration scenario. If you could, the name/value
pair scheme would be perfectly viable, but Trond has very clearly
explained why it is not reasonable to assume that.

But, for early going you may get away with telling people that
the configuration has to be identical. They won't listen and will
mess it up, but you will probably get away with it.

Casey Schaufler
casey@...aufler-ca.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/