From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750935AbWDQXJo (ORCPT ); Mon, 17 Apr 2006 19:09:44 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1750898AbWDQXJn (ORCPT ); Mon, 17 Apr 2006 19:09:43 -0400 Received: from 216-99-217-87.dsl.aracnet.com ([216.99.217.87]:12417 "EHLO sorel.sous-sol.org") by vger.kernel.org with ESMTP id S1750876AbWDQXJn (ORCPT ); Mon, 17 Apr 2006 19:09:43 -0400 Date: Mon, 17 Apr 2006 16:09:23 -0700 From: Chris Wright To: Gerrit Huizenga Cc: James Morris , "Serge E. Hallyn" , Stephen Smalley , casey@schaufler-ca.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, fireflier-devel@lists.sourceforge.net Subject: Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks Message-ID: <20060417230923.GG3615@sorel.sous-sol.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.1i Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org * Gerrit Huizenga (gh@us.ibm.com) wrote: > I get the impression from customers that SELinux is so painful to > configure correctly that most of them disable it. In theory, LSM + > something like AppArmour provides a much simpler security model for > normal human beings who want some level of configuration. Also, > the current SELinux config in RH is starting to have a measureable > performance impact. I'm not sure this particular battle of the > security models is quite over from a real user perspective. SELinux usability is not the same issue as having LSM in the kernel. So, I agree, usability can improve, but having AppArmor as external patchkit is not helping show LSM is needed in upstream tree. It needs to survive review and get upstream as a means to showing the use of LSM. thanks, -chris