Re: Assurance, permissiveness, and restriction

From: Titus D. Winters (titusat_private)
Date: Mon Jun 04 2001 - 10:15:41 PDT

  • Next message: Stephen Smalley: "Re: permissive vs. restrictive issue and solutions..."

    I still maintain that the way to go here is to push it all into the module
    and make the default module contain the current kernel logic.
    
    The points I would like to make are:
    
    1. Political difficulties should not be considered in the design of
    software.  Anyone that says otherwise is trying to avoid a flamewar.
    Personally, I'd rather fight the flamewar battle personally and let
    someone else do the development if that's what it takes to get it done
    right the first time.
    
    2. Condensing all of the default hook logic into security.c / security.h
    does _not_ reduce the number of eyeballs looking at it, it just moves
    everything important (to us security geeks) into one place so that we can
    actually find the things that we are looking for in the (woefully
    underdocumented) kernel source.
    
    -Titus
    
    
    
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Mon Jun 04 2001 - 10:17:04 PDT