On Thu, 5 Jul 2001, Crispin Cowan wrote: > Ted agreed with the consensus the LSM list came to a few weeks ago: > movking kernel logic out to a module is too intrusive and too > risk-prone, so don't do it. This statement seems to highlight why capabilities support has been so difficult to strategize, and why some of the "thinking" about it has leaked over to threaten contamination of other parts of the interface. The original "move capabilities to a module" value that partly triggered LSM now seems somewhat inconsistant... we're not really doing that at all: just *extending* capabilities support to a module, leaving it basicly intact in the kernel, and treating it the same way we're treating any other pre-existing kernel security mechanism: extending, not moving. If that's the case, shouldn't we revert ANY kernel logic moved OUT, for any purpose, and "bite the bullet a little on invasiveness" to change the kernel-side logic if and only if it is absolutely necessary to isolate our hook, using the "extend only" argument to cover these changes as being the least restrictive to meet the need? If "one step at a time" is the best way to sell LSM, we're taking two steps with our first leap: capabilities and restrictive access controls, trying to get the sugar from capabilities to help balance the bitter from restrictive. Sincerely, J. Melvin Jones |>------------------------------------------------------ || J. MELVIN JONES jmjonesat_private |>------------------------------------------------------ || Microcomputer Systems Consultant || Software Developer || Web Site Design, Hosting, and Administration || Network and Systems Administration |>------------------------------------------------------ || http://www.jmjones.com/ |>------------------------------------------------------ _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Fri Jul 06 2001 - 09:58:26 PDT