Re: New stacker performance results

From: Crispin Cowan (crispin@private)
Date: Wed May 25 2005 - 15:57:39 PDT

Colin Walters wrote:
>On Wed, 2005-05-25 at 17:33 -0400, Valdis.Kletnieks@private wrote:
>>The point is that SELinux is able to do a very good job at controlling access
>>via a model where everything is *labelled*.  
>Yes.  And it provides plenty of tools for labeling; from fine-grained
>xattrs on files to giving all files on a particular mount the same
>label.  What's the big deal?
The big deal from my perspective is that some of us believe that
label-based access control in itself is a defect, and there are other
ways to do it that are more effective. The SELinux procedure to build a
policy to contain an application is 17 steps long (literally) and the
corresponding Immunix process is 3 steps long, and the steps are easier.

But "easier" is a subjective opinion, and I don't particularly want to
engage in SELinux bashing. It has its strengths. The claim is just that
there are alternatives that have their strengths too. LSM currently lets
the user make that choice. Forcing everyone to cram their ideas through
the SELinux model would severely compromise that.

So there are SEVERE disadvantages to removing LSM and forcing everyone
to just use SELinux. What are the advantages? I mean, other than
excluding all those annoying counter-revolutionary upstarts? :)

Crispin Cowan, Ph.D.            
Director of Software Engineering, Novell

This archive was generated by hypermail 2.1.3 : Wed May 25 2005 - 15:58:50 PDT