lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 3 Aug 2022 14:29:40 +1000 From: Daniil Lunev <dlunev@...omium.org> To: Eric Biggers <ebiggers@...nel.org> Cc: Zdenek Kabelac <zdenek.kabelac@...il.com>, Brian Geffon <bgeffon@...gle.com>, Mike Snitzer <snitzer@...nel.org>, linux-kernel@...r.kernel.org, dm-devel@...hat.com, Mikulas Patocka <mpatocka@...hat.com>, Alasdair Kergon <agk@...hat.com> Subject: Re: [dm-devel] [PATCH 1/1] dm: add message command to disallow device open > This seems like an access control policy, which the Linux kernel already has a > lot of mechanisms for. Chrome OS already uses SELinux. Couldn't this be solved > by giving the device node an SELinux label that no one has permission to open? That would be the ideal solution, but there is a number of challenges that prevent us enabling enforcement on all SELinux domains unfortunately. While in the long run that would be a preferred option, in the short run this doesn't seem feasible. I would assume the problem of enabling full SELInux enforcement would plague any big project that didn't have them enabled from the get going. --Daniil
Powered by blists - more mailing lists