linux-kernel - Re: [PATCH v4 2/14] Add TSEM specific documentation.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2b09859e-e16b-4b58-987c-356d3fffa4fe@schaufler-ca.com>
Date: Tue, 25 Feb 2025 07:48:31 -0800
From: Casey Schaufler <casey@...aufler-ca.com>
To: "Dr. Greg" <greg@...ellic.com>, Paul Moore <paul@...l-moore.com>
Cc: linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org,
 jmorris@...ei.org, Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH v4 2/14] Add TSEM specific documentation.

On 2/25/2025 4:01 AM, Dr. Greg wrote:
> On Tue, Jan 28, 2025 at 05:23:52PM -0500, Paul Moore wrote:
>
> For the record, further documentation of our replies to TSEM technical
> issues.
>
> ...
>
> Further, TSEM is formulated on the premise that software teams,
> as a by product of CI/CD automation and testing, can develop precise
> descriptions of the security behavior of their workloads.

I've said it before, and I'll say it again. This premise is hopelessly
naive. If it was workable you'd be able to use SELinux and audit2allow
to create perfect security, and it would have been done 15 years ago.
The whole idea that you can glean what a software system is *supposed*
to do from what it *does* flies completely in the face of basic security
principles.