Greg KH wrote: >On Tue, Dec 24, 2002 at 12:22:21PM -0800, Crispin Cowan wrote: > >>Single child; hmmm. Does that mean "stacker + one functional module"? Or >>"stacker + capabilities + one other module"? I expect the common cases >>to be: >> >> 1. capabilities only: oblivious users who don't do anything to >> enhance kernel security, and just load up the defaults. >> >> >Hm, tell us how you really feel about "oblivious users" :) > Huh? LSM has always been about allowing users to make this choice. If the machine in question is in a benign environment (i.e. disconnected from the Internet) then this is a very sound decision. >> 2. capabilities + OWLSM: nearly oblivious users who want to just add >> the "zero management" security of OWLSM. >> >> >owlsm already merges both functionality together today in one module, no >"stacking" needed. > Neat. >> 3. capabilities + OWLSM + MAC: where "MAC" is one of SELinux, LIDS, >> DTE, or SubDomain, etc. Users taking active steps to enhance >> security with MAC. >> >> >And playing with fire. Who's going to ever agree to say that their >module will work just fine stacking with an unknown list of other >modules. > Who said "unknown"? It is intended to be a known set of modules. The "etc." above is intended to say that the set of MAC vendors is not a closed club. >And who would really want that speed hit on their machine :) > Can you substantiate that? The MAC modules have a known cost, and the OWLSM module is close to performance-neutral. Why should stacking all this up cause a performance hit? Crispin -- Crispin Cowan, Ph.D. Chief Scientist, WireX http://wirex.com/~crispin/ Security Hardened Linux Distribution: http://immunix.org Available for purchase: http://wirex.com/Products/Immunix/purchase.html Just say ".Nyet"
This archive was generated by hypermail 2b30 : Fri Dec 27 2002 - 09:59:36 PST