Re: [RFC] TOMOYO Linux released!

Hello,

Rik van Riel wrote:
> Why does the Tomoyo patch have its own hooks in various
> places sitting right next to the LSM hooks?
There are two reasons.

One is to support both 2.4 kernels and 2.6 kernels.

The other is some parameters are missing for TOMOYO Linux.
TOMOYO needs "struct vfsmnt" parameter to calculate realpath(2),
but this parameter is unavailable after entring into
the vfs functions (for example, vfs_mknod()) and
unable to use (for example, security_inode_mknod()).

Also not all hooks needed for TOMOYO Linux are provided by LSM.
For example, a hook for SAKURA_MayAutobind() is not provided by LSM.



By the way, the kickstart guide is now available at
http://tomoyo.sourceforge.jp/en/kickstart/ .

If you have private questions, you can send mails to
tomoyo-support _at_ lists.sourceforge.jp .

Regards...
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: [TOMOYO #7 30/30] Hooks for SAKURA and TOMOYO.
    ... TOMOYO Linux 1.6 doesn't use LSM because of the following reasons. ... reasoning for abandoning LSM in favor of a new set of hooks, however, I ... Let me explain the reason and the history. ...
    (Linux-Kernel)
  • Re: [TOMOYO #7 30/30] Hooks for SAKURA and TOMOYO.
    ... TOMOYO Linux 1.6 doesn't use LSM because of the following reasons. ... I understand your frustration with the existing LSM hooks/API and your reasoning for abandoning LSM in favor of a new set of hooks, however, I think this sets a dangerous precedence which could result in an abundance of security related hooks scattered throughout the kernel. ... Let me explain the reason and the history. ...
    (Linux-Kernel)
  • Re: [TOMOYO #7 30/30] Hooks for SAKURA and TOMOYO.
    ... TOMOYO Linux 1.6 doesn't use LSM because of the following reasons. ... reasoning for abandoning LSM in favor of a new set of hooks, however, I ...
    (Linux-Kernel)
  • Re: [TOMOYO 00/15](repost) TOMOYO Linux - MAC based on process invocation history.
    ... TOMOYO Linux has many countermeasures that prevents many of pathname-based access control's problems. ... Common implementations treat policy file on the filesystem as the up-to-date data, ... Current network-related LSM hooks can't know the final recipient of connections and/or packets. ...
    (Linux-Kernel)
  • Re: [TOMOYO #7 30/30] Hooks for SAKURA and TOMOYO.
    ... TOMOYO Linux 1.6 doesn't use LSM because of the following reasons. ... reasoning for abandoning LSM in favor of a new set of hooks, however, I ...
    (Linux-Kernel)