Hi, I'm now writing a "safe networking" LSM, inspired by grSecurity socket restriction capabilities. Currently, it provides users and groups (uid and gid based) Access Control Lists, which can be changed in runtime by a new interface based on my other LSM, the TPE, which registers a subsystem in sysfs and creates the needed entries for "realtime" configuration under secfs in the mountpoint of sysfs (normally /sys/). I'ts intended to provide a base of enhanced features inspired by the well-designed grSecurity patch maintained and developed by Brad Spengler (a.k.a. spender), by now i have the TPE and this LSM almost done. The main goal is to provide an also well-designed (as most as possible) security improvement using the LSM framework for Vanilla sources. The main problem is that people often needs security enhancements that they can not get by using the default Vanilla sources, even in an easy, "user friendly" way. What's more simple than insmod'ding a module? Maybe the LSM framework is not the best one, or it's just not reliable for this as some people and colectives said before, but i want to give it a chance, even if this work could be nonsense for some people, it's also for my own fun and coding profit. If someone wants to help with this idea (i can not call it a project but seems going to be :) ), just tell me. Also, i would appreciate knowing the opinion from both kernel hackers and users "vocal" base, about the inclusion of this security improvements in the main line. Tomorrow, my school time will start again after these Christmas holidays, so, i will have more limited time and less nights (umm, none maybe) to work on this stuff, until i get spin_unlock()'ed again ;). Thanks in advance, cheers. -- Lorenzo Hernández García-Hierro <lorenzo@private> [1024D/6F2B2DEC] [2048g/9AE91A22] Hardened Debian head developer & project manager
This archive was generated by hypermail 2.1.3 : Sun Jan 09 2005 - 11:44:15 PST