Re: MAC before DAC vs DAC before MAC

From: David Wagner (dawat_private)
Date: Thu Jul 26 2001 - 15:44:30 PDT

  • Next message: T.R.Y.: "security policy and xml"

    richard offer  wrote:
    >This gets annoying very quickly to real users doing real permitted things. 
    >
    >If "ls -l" requires going to out to the tape unit only then to return
    >"permission denied", the time taken will be longer than it takes customers
    >to file a bug. 
    
    Well, this seems like an awfully contrived example.  But assuming
    for the sake of discussion that there are better examples, you seem
    to be suggesting that:
     - there are operations that take a long time on the non-B1 version
       of Irix but take much less time on the B1 version of the OS,
     - these operations are regularly and commonly used by real users,
     - users would complain if these operations took as long under the
       B1 OS as they do under the non-B1 version of the OS.
    Is that right?  If I understood you correctly, these are a surprising
    combination of assertions.
    
    If you have to deal with users like this in Irix, you have my sympathies.
    Personally, I don't think I'd be able to keep a straight face if a user
    who expected Janus to speed up his favorite application by a factor of
    2x came and complained to me when Janus didn't live up this expectation.
    
    I must admit, I'm still unconvinced that this concern should be given
    any weight in our discussions of the LSM architecture.
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Thu Jul 26 2001 - 22:04:58 PDT