From: Chris Wright <chrisw@osdl.org>
To: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Chris Wright <chrisw@osdl.org>, Andrew Morton <akpm@osdl.org>,
lkml <linux-kernel@vger.kernel.org>
Subject: Re: [RFC] [PATCH] [0/6] LSM Stacking
Date: Thu, 4 Nov 2004 17:05:55 -0800 [thread overview]
Message-ID: <20041104170555.G2357@build.pdx.osdl.net> (raw)
In-Reply-To: <20041105010112.GC3792@IBM-BWN8ZTBWA01.austin.ibm.com>; from serue@us.ibm.com on Thu, Nov 04, 2004 at 07:01:12PM -0600
* Serge E. Hallyn (serue@us.ibm.com) wrote:
> Hi,
>
> Quoting Chris Wright (chrisw@osdl.org):
> ...
> > I think, all in all, this needs more work and more justification (esp.
> > w.r.t. overhead and impact on the current common use of a single
> > module).
>
> Would it help to make CONFIG_NUM_LSMS a boot time option, and default
> to 1?
That number is only valid at compile time (it defines structure sizes,
etc).
> As for justification, the fact that many LSMS currently cannot be
> used simultaneously seemed the most prominent. It certainly seems viable
> to use SELinux to protect audit logs and shadow files, use bsdjail to
> offer certain services, and use securelevel for some generic hardening,
> for instance.
Understood, although I don't think you'll get SELinux folks to agree
that it could be useful in conjuction with other modules like that. The
real bottom line is that it can't slow anything down for the single
module case.
thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
next prev parent reply other threads:[~2004-11-05 1:11 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-11-04 23:04 Serge Hallyn
2004-11-04 22:52 ` Chris Wright
2004-11-05 1:01 ` Serge E. Hallyn
2004-11-05 1:05 ` Chris Wright [this message]
2004-11-05 2:16 ` James Morris
2004-11-04 23:06 ` [RFC] [PATCH] [1/6] LSM Stacking: Replace LSM void* with arrays Serge Hallyn
2004-11-04 22:34 ` Chris Wright
2004-11-04 23:08 ` [RFC] [PATCH] [2/6] LSM Stacking: Add stacker LSM Serge Hallyn
2004-11-04 22:42 ` Chris Wright
2004-11-10 17:43 ` Jonathan Corbet
2004-11-10 19:32 ` Serge E. Hallyn
2004-11-04 23:08 ` [RFC] [PATCH] [3/6] LSM Stacking: capability LSM stacking support Serge Hallyn
2004-11-04 23:09 ` [RFC] [PATCH] [4/6] LSM Stacking: seclvl " Serge Hallyn
2004-11-04 23:11 ` [RFC] [PATCH] [5/6] LSM Stacking: SELinux " Serge Hallyn
2004-11-04 22:45 ` Chris Wright
2004-11-04 23:12 ` [RFC] [PATCH] [6/6] LSM Stacking: temporary setprocattr hack Serge Hallyn
2004-11-04 22:48 ` Chris Wright
2004-11-05 0:52 ` Serge E. Hallyn
2004-11-05 0:56 ` Chris Wright
2004-11-04 23:14 ` [RFC] [PATCH] [1/3] LSM Stacking: stackable bsdjail (tasklookup) Serge Hallyn
2004-11-04 23:15 ` [RFC] [PATCH] [2/3] LSM Stacking: stackable bsdjail (bsdjail lsm) Serge Hallyn
2004-11-04 23:16 ` [RFC] [PATCH] [3/3] LSM Stacking: stackable bsdjail (Documentation) Serge Hallyn
2004-11-04 23:51 ` [RFC] [PATCH] [0/6] LSM Stacking James Morris
2004-11-05 7:23 ` Valdis.Kletnieks
2004-11-05 16:32 ` Serge E. Hallyn
2004-11-05 16:51 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20041104170555.G2357@build.pdx.osdl.net \
--to=chrisw@osdl.org \
--cc=akpm@osdl.org \
--cc=linux-kernel@vger.kernel.org \
--cc=serue@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®