linux-kernel - Re: Preview of changes to the Security susbystem for 2.6.36

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201008040700.o7470LWi021902@www262.sakura.ne.jp>
Date:	Wed, 04 Aug 2010 16:00:21 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:	Valdis.Kletnieks@...edu
Cc:	hch@...radead.org, jmorris@...ei.org, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, viro@....linux.org.uk,
	kees.cook@...onical.com
Subject: Re: Preview of changes to the Security susbystem for 2.6.36

Valdis.Kletnieks@...edu wrote:
> Are you sure you weren't running in permissive mode when you tested this?
I'm running CentOS5.5 and RHEL6beta in enforcing mode with default configuration
(TARGETED policy).

> I am unable to replicate this behavior on my system with SELinux set to
> enforcing mode.  However, it does happen (which is to be expected) when SELinux
> is set to permissive mode.
So, MLS policy can stop this case, can't it? That's fine.

But most people is using TARGETED policy, isn't it?
How do you provide protection to those who don't use MLS policy?

SSHD case is just an example which everyone can try handily.
What I want to say is that it is up to application that how the application
uses information if the application is allowed to access the information. Thus,
we should try to control parameters that affect how the information is used
as much as possible in addition to controlling whether the application can
reach the information or not.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/