Re: OWL module implementation

crispinat_private

Jonathan Heusser wrote:

> Crispin Cowan wrote:
>
>> Basically, OWLSM implements what it can and what is needed.
>>
>> It also got used as a place to implement a "no ptrace for root 
>> processes" hack. I'm not sure if that hack is in the BK published 
>> version or not, but it should be. 
>
> I don't really see which features get implemented by which module .. 
> or is there no strict separation
> between the tasks of the modules 'capability' and 'owlsm' ? 

Well, LSM per se is just a framework for modules, so you can put what 
ever you want in modules that *you* develop.

Each module in turn has its own design and purpose.

    * The Capabilities module is strictly intended to reproduce the
      functionality of the POSIX capability features found in the 2.4
      kernel, but in module form.
    * The OWLSM mdoule started out attempting to reproduce as much of
      the Openwall kernel as possible. That turns out to be a grab-bag
      of pathology prevention techniques, so it makes sense to add more
      of those kind of features to OWLSM. In particula:
          o The OWLSM module requires *zero* configuration (other than
            an on/off switch per feature would be nice) so try to stick
            to features that don't need configuring.
          o Many of the other modules don't stack well with each other
            (it makes no sense to use SELinux and LIDS together) but
            OWLSM can (in theory) compose with most of the other
            modules. So try to preserve that composability, too.

> For instance "no ptrace for root processes" might as well fit in the 
> capabilities module in my opinion. 

That could be done, but it would not fit the purpose of the Capabilities 
module.

Crispin

-- 
Crispin Cowan, Ph.D.                      http://wirex.com/~crispin/
Chief Scientist, WireX                    http://wirex.com
HP/Trend Micro Immunix Secured Solutions
http://h18000.www1.hp.com/products/servers/solutions/iis/
			    Just say ".Nyet"

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module