* Serge E. Hallyn (hallyn@private) wrote: > LSM hooks can also be used for performance measurements, to aid an audit > subsystem, etc. And with LSM's like bsdjail and securelevel, stacking with > SELinux is still useful even though all are purely security modules. Only valid use is for access control (and I'll agree it can aid audit). > > I don't think arbitary composition of security models is a service that > > the Linux kernel should provide. > > Here we fundamentally disagree. Something which can be unsafe for some if > improperly used, but useful for others, should not therefore be disabled. Problem is showing it's useful enough to make a change. The biggest issue I see is that the current scheme is tough to code for both ways. The module has to make a choice how to code itself w.r.t. stacking and accessing it's security labels. thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
This archive was generated by hypermail 2.1.3 : Wed Oct 27 2004 - 10:44:10 PDT