linux-kernel - Re: Implementing a Linux Security Module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 13 Apr 2008 09:23:44 -0700 (PDT)
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	"d.capitella@....it" <d.capitella@....it>,
	linux-kernel@...r.kernel.org,
	LSM List <linux-security-module@...r.kernel.org>
Subject: Re: Implementing a Linux Security Module


--- "d.capitella@....it" <d.capitella@....it> wrote:

> Hi there! I'm studying the Linux Security Module Framework, and I'm
> experiencing some issues while trying to register the modules I create.
> 
> I created a basic test module that just registers itself as a lsm. I
> tried to load it on many distros, Ubuntu, Fedora, RedHat but it is not
> allowed to register. 
> 
> May this be due to other LSMs that doesn't 
> support stacking and that are
> already loaded on those distros? If 
> that's the problem, can't we just
> create a security module that does 
> nothing but managing the stacking of
> other security modules?

Yes, that is an option.

There was work on a stacking module early on, but the
lack of available modules and some of the stickier interaction
issues lead to it being set aside.

It certainly makes sense to stack a time-clock access
module and a physical location module. It would not
make sense to stack SELinux and ... well, anything.

What you need to do in the current environment is build your
own kernel, not just the module. It takes more time, disk,
and cpu, but that's about it.


Casey Schaufler
casey@...aufler-ca.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/