linux-kernel - Re: Preview of changes to the Security susbystem for 2.6.36

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1280774061.2673.115.camel@moss-terrapins.epoch.ncsc.mil>
Date:	Mon, 02 Aug 2010 14:34:21 -0400
From:	"David P. Quigley" <dpquigl@...ho.nsa.gov>
To:	Kees Cook <kees.cook@...onical.com>
Cc:	Christoph Hellwig <hch@...radead.org>,
	James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, Al Viro <viro@....linux.org.uk>
Subject: Re: Preview of changes to the Security susbystem for 2.6.36

On Mon, 2010-08-02 at 09:59 -0700, Kees Cook wrote:
[...snip]
> 
> I've seen two so far. Both are addressed with a one line fix. And I would
> stress that no other existing subsystem in the kernel can provide the same
> level of control that my ptrace exception logic provides. SELinux cannot do
> this.
> 

Would you mind explaining to me what you believe this patch can do that
SELinux can't? Based on what I read in the kconfig entry for the feature
and the subsequent exception patch I'm not seeing anything here that
SELinux can't do. If there is something we are missing I'd like to
understand it so we can make the decision on whether or not our ptrace
access control checks need to be modified.

Dave


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/