| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <21d7e9971003090046n7da34978n36b1745184f412a@mail.gmail.com> Date: Tue, 9 Mar 2010 18:46:33 +1000 From: Dave Airlie <airlied@...il.com> To: Ingo Molnar <mingo@...e.hu> Cc: Linus Torvalds <torvalds@...ux-foundation.org>, Alan Cox <alan@...rguk.ukuu.org.uk>, James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org, Kyle McMartin <kyle@...artin.ca>, Alexander Viro <viro@....linux.org.uk> Subject: Re: Upstream first policy On Tue, Mar 9, 2010 at 5:29 PM, Ingo Molnar <mingo@...e.hu> wrote: > > * Linus Torvalds <torvalds@...ux-foundation.org> wrote: > >> On Mon, 8 Mar 2010, Alan Cox wrote: >> > >> > man restorecond >> >> I know. I also sometimes sit through minutes of "let's relabel the system, >> because you've booted a kernel without selinux support". > > I've had selinux relabeling wait times of an hour or two too, on a > sufficiently large filesystem. > > I think this hurts security far more than anything else, because it causes > people to actually _turn off the whole thing_ - so we will have less and less > security in the end. > > ( To use the obligatory fire door analogy: we should prefer a one inch thick > fire door that opens and closes fully automated to a five inches thick fire > door that people keep always-open with a chair. ) selinux relabels are the new fsck. maybe we need selinux3 or chunk-selinux. Dave. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists