linux-kernel - Re: cgroup: status-quo and userland efforts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPweEDwK06gCjCrzQghd8xYLgH=RtHAO6sN=s+APUeJkO+Voow@mail.gmail.com>
Date:	Wed, 4 Mar 2015 11:27:40 +0000
From:	Luke Kenneth Casson Leighton <lkcl@...l.net>
To:	David Lang <david@...g.hm>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: cgroup: status-quo and userland efforts

On Wed, Mar 4, 2015 at 5:08 AM, David Lang <david@...g.hm> wrote:
> On Tue, 3 Mar 2015, Luke Leighton wrote:

>> whilst the majority of people view management to be "hierarchical"
>> (so there is a top dog or God process and everything trickles down
>>  from that), this is viewed as such an anathema in the security
>> industry that someone came up with a formal specification for the
>> real-world way in which permissions are managed,

 sorry i should have said "managed in the security esp. defense industry"

>> and it's called the FLASK model.
>
>
> On this topic it's also worth reading Neil Brown's series of articles on
> this over at http://lwn.net/Articles/604609/

 oo good background, thank you david.  happily reading now :)

> and why he concludes that having a single hierarchy for all resource types.

 i think.... having a single hierarchy is fine *if* and only if it is
possible to overlay something similar to SE/Linux policy files -
enforced by the kernel *not* by userspace (sorry serge!) - such that
through those policy files any type of hierarchy be it single or multi
layer, recursive or in fact absolutely anything, may be emulated and
properly enforced.

l.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/