Re: What went wrong with LSM, was: Re: [BK PATCH] LSM changes for 2.5.59

From: Crispin Cowan (crispinat_private)
Date: Wed Feb 12 2003 - 20:37:51 PST

  • Next message: Crispin Cowan: "Re: What went wrong with LSM, was: Re: [BK PATCH] LSM changes for 2.5.59"

    'Christoph Hellwig' wrote:
    
    >On Wed, Feb 12, 2003 at 02:22:34PM -0800, Crispin Cowan wrote:
    >
    >>LSM does have an abstract design: it mediates 
    >>access to major internal kernel objects (processes, inodes, etc.) by 
    >>user-space processes, throwing access requests out to the LSM module.
    >>    
    >>
    >We seem to use the term design differently.  And maybe my english
    >wording wasn't perfect (I'm no native speaker..).  My objection is that
    >LSM by itself does not enforce the tightest bit of security policy
    >design.  Your "design" is putting in hooks before object accesses
    >without making them tied to enforcing some security policy.
    >
    You're right, we're using English differently :-) I don't know what the 
    above paragraph means. I can guess, but that's where the trouble is 
    coming from. Based on the guessing:
    
        * Yes, LSM by itself does not enforce security policy.
        * Yes, the desing is to put hooks in front of important objects, and
          ask the modules if that access is ok.
    
    The effect of this is to push security policy out to the modules. This 
    is what Linus asked for, so that he would not have to maintain security 
    policy or security policy engines.
    
    >When reading this thread some people (e.g. David [*]) still seem that
    >changes should be done for LSM's sake - but that's entirely wrong.
    >The point of getting LSM or something similar in is for the sake
    >of the _linux_ _kernel_ getting usefull features, not for enabling
    >some small community writing out of tree modules.
    >
    You have often made this point about "for the Linux kernel's sake" vs. 
    some other motivation, and it bothers me. It suggests that you somehow 
    care about the Linux kernel more than I do. No, I care about the Linux 
    kernel a lot. More over, I don't see how "who cares about the kernel 
    more" is pertinent.
    
    That aside, the Linux kernel per se is not some entity to be pleased 
    like a stone god. Linux exists for its users. LSM is designed to benefit 
    Linux kernel users. Some benefit by being able to add security features 
    that they could not get before, because they are not capable of patching 
    their own kernels. Some benefit by being able to produce experimental 
    security modules without having to patch & track the Linux kernel. Some 
    benefit by being able to unload security stuff and go for a leaner 
    configuration.
    
    LSM is not about pleasing a small number of module vendors. It is about 
    benefiting a large number of potential users.
    
    Crispin
    
    -- 
    Crispin Cowan, Ph.D.
    Chief Scientist, WireX                      http://wirex.com/~crispin/
    Security Hardened Linux Distribution:       http://immunix.org
    Available for purchase: http://wirex.com/Products/Immunix/purchase.html
    			    Just say ".Nyet"
    
    
    
    

    _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module



    This archive was generated by hypermail 2b30 : Wed Feb 12 2003 - 20:38:20 PST