Re: LSM conversion to static interface


On Oct 19 2007 13:40, Linus Torvalds wrote:
On Fri, 19 Oct 2007, Andreas Gruenbacher wrote:

Non-trivial modules (i.e., practically everything beyond capabilities) become
effective only after loading policy, anyway. If you can load policy, you can
as well first load a security module without making the system insecure.

I'd like to note that I asked people who were actually affected, and had
examples of their real-world use to step forward and explain their use,
and that I explicitly mentioned that this is something we can easily
re-visit.


I do have a pseudo LSM called "multiadm" at
http://freshmeat.net/p/multiadm/ , quoting:

The MultiAdmin security framework kernel module provides a means
to have multiple "root" users with unique UIDs. This bypasses
collation order problems with NSCD, allows you to have files
with unique owners, and allows you to track the quota usage for
every "real" user. It also implements a "sub-admin", a partially
restricted root user who has full read-only access to most
subsystems, but write rights only to a limited subset, for
example writing to files or killing processes only of certain
users.

The use case is so that profs (taking the role of sub-admins), can
operate on student's data/processes/etc. (quite often needed), but
without having the full root privileges.

Policy is dead simple since it is based on UIDs. The UID ranges can be
set on module load time or during runtime (sysfs params). This LSM is
basically grants extra rights unlike most other LSMs[1], which is why
modprobe makes much more sense here. (It also does not have to do any
security labelling that would require it to be loaded at boot time
already.)

Does that sound productive?


The fact is, security people *are* insane. You just argue all the time,
instead fo doing anything productive. So please don't include me in the Cc
on your insane arguments - instead do something productive and I'm
interested.

[1] SELinux: What I remember from coker.com.au's selinux test machine,
everyone had UID 0 and instead had powers revoked.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/