linux-kernel - Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <489913CF.1010708@schaufler-ca.com>
Date:	Tue, 05 Aug 2008 20:00:31 -0700
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Paul Moore <paul.moore@...com>
CC:	Cliffe <cliffe@...net>, Eric Paris <eparis@...hat.com>,
	malware-list@...ts.printk.net, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

Paul Moore wrote:
> On Monday 04 August 2008 11:44:28 pm Casey Schaufler wrote:
>   
>> Cliffe wrote:
>>     
>>> Other security schemes such as intrusion detection,
>>> firewalls/netfilter, anti-malware, and application restrictions
>>> (sandboxes such as jails or finer grained restrictions such as
>>> AppArmor) could all register LSMs onto the stack.
>>>       
>> Stacking is easy for files. It's a real pain in the backside for UDP
>> packets.
>>     
>
> How is it any better/worse for UDP packets than files?
>   
On delivery you'd need to decide what security scheme is actually
available on the packet and in what order to interpret any inbound
security data. If you had an MLS scheme that uses CIPSO, an integrity
mechanism using IPSEC and a DAC scheme that assigns user ids by
host address getting the ordering right and every domain registered
properly in the networking stack would be a trick. Plus, making sure
that any state the security scheme requires is tricky. Maybe it's not
actually worse if the schemes agree on what qualifies as a security
element, but if one scheme does access control outbound while another
does inbound it will get hairy.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/