Re: What went wrong with LSM, was: Re: [BK PATCH] LSM changes for 2.5.59

crispinat_private

'Christoph Hellwig' wrote:

>On Wed, Feb 12, 2003 at 02:22:34PM -0800, Crispin Cowan wrote:
>
>>LSM does have an abstract design: it mediates 
>>access to major internal kernel objects (processes, inodes, etc.) by 
>>user-space processes, throwing access requests out to the LSM module.
>>    
>>
>We seem to use the term design differently.  And maybe my english
>wording wasn't perfect (I'm no native speaker..).  My objection is that
>LSM by itself does not enforce the tightest bit of security policy
>design.  Your "design" is putting in hooks before object accesses
>without making them tied to enforcing some security policy.
>
You're right, we're using English differently :-) I don't know what the 
above paragraph means. I can guess, but that's where the trouble is 
coming from. Based on the guessing:

    * Yes, LSM by itself does not enforce security policy.
    * Yes, the desing is to put hooks in front of important objects, and
      ask the modules if that access is ok.

The effect of this is to push security policy out to the modules. This 
is what Linus asked for, so that he would not have to maintain security 
policy or security policy engines.

>When reading this thread some people (e.g. David [*]) still seem that
>changes should be done for LSM's sake - but that's entirely wrong.
>The point of getting LSM or something similar in is for the sake
>of the _linux_ _kernel_ getting usefull features, not for enabling
>some small community writing out of tree modules.
>
You have often made this point about "for the Linux kernel's sake" vs. 
some other motivation, and it bothers me. It suggests that you somehow 
care about the Linux kernel more than I do. No, I care about the Linux 
kernel a lot. More over, I don't see how "who cares about the kernel 
more" is pertinent.

That aside, the Linux kernel per se is not some entity to be pleased 
like a stone god. Linux exists for its users. LSM is designed to benefit 
Linux kernel users. Some benefit by being able to add security features 
that they could not get before, because they are not capable of patching 
their own kernels. Some benefit by being able to produce experimental 
security modules without having to patch & track the Linux kernel. Some 
benefit by being able to unload security stuff and go for a leaner 
configuration.

LSM is not about pleasing a small number of module vendors. It is about 
benefiting a large number of potential users.

Crispin

-- 
Crispin Cowan, Ph.D.
Chief Scientist, WireX                      http://wirex.com/~crispin/
Security Hardened Linux Distribution:       http://immunix.org
Available for purchase: http://wirex.com/Products/Immunix/purchase.html
			    Just say ".Nyet"