Re: [BK PATCH] LSM changes for 2.5.59

crispinat_private

LA Walsh wrote:

>>From: Crispin Cowan
>>
>>LSM does have a careful design.... meeting a 
>>goal stated by Linus nearly two years ago.
>>    
>>
>	A security model that mediates access to security objects by
>logging all access and blocking access if logging cannot continue is
>unsupportable in any straight forward, efficient and/or non-kludgy, ugly
>way. 
>
Because Linus asked for access control support, not audit logging 
support, it is not surprising that logging models don't fit so well.

>  Some security people were banned from the kernel
>devel. summit because their thoughts were deemed 'dangerous': fear was they
>were too persuasive about ideas that were deemed 'ignorant' and would
>fool those poor kernel lambs at the summit.
>
Internal SGI politics.

>	Also unsupported: The "no-security" model -- where all security 
>is thrown out (to save memory space and cycles) that was desired for embedded work.
>
False: capabilities is now a removable module, which is what Linus asked 
for.

>	LSM also doesn't support standard LSPP-B1 style graded security
>where mandatory access checks are logged as security violations before
>DAC checks are even looked at for an object.
>
Because doing so would have required approx. 6-10X as many LSM hooks as 
the current LSM. Speak up if you think LSM should be 10X bigger to be 
able to support Common Criteria standards compliant audit logging ...

>	At one point a plan was proposed (by Casey Schaufler, SGI) and 
>_\implemented\_ (team members & prjct lead Linda Walsh) to move all
>security checks out of the kernel into a 'default policy' module.
>The code to implement this was submitted to the LSM list in June 1991.
>
And I actually like that plan. But I still believe it to be too radical 
for 2.6. It has many nice properties, but is much more invasive to the 
kernel. I think it is a very interesting idea for 2.7, and should be 
floated past the maintainers who will be impacted to see if it has a 
hope in hell.

Crispin

-- 
Crispin Cowan, Ph.D.
Chief Scientist, WireX                      http://wirex.com/~crispin/
Security Hardened Linux Distribution:       http://immunix.org
Available for purchase: http://wirex.com/Products/Immunix/purchase.html
			    Just say ".Nyet"