Re: [TOMOYO 1/2] tomoyo: add Documentation/tomoyo.txt

[Peter Dolding <oiaohm@gmail.com>]

> +
> +We believe that inode based security and name based security are complementary
> +and both should be used together. But unfortunately, so far, we cannot enable
> +multiple LSM modules at the same time. We feel sorry that you have to give up
> +SELinux/SMACK/AppArmor etc. when you want to use TOMOYO.
> +
> +We hope that LSM becomes stackable in future. Meanwhile, you can use non-LSM
> +version of TOMOYO, available at http://tomoyo.sourceforge.jp/en/1.6.x/ .
> +LSM version of TOMOYO is a subset of non-LSM version of TOMOYO. We are planning
> +to port non-LSM version's functionalities to LSM versions.
>
If you go back through the mailing list you will find stackable has
been debated at length many times.

AppArmor and Tomoyo are both name based.  So unlikely you would want
both at the same time.

LSM exists mostly because designers of security systems could not
decide on the 1 default Linux should have.

For inode and name based security the question should be can Tomoyo
merge with the other LSM modules in away that avoids stacking.

Smack and Selinux are sharing code in places with each other.   Really
there are only 3 currently active developed LSM's Smack Selinux and
Tomoyo.  Merge could basically get us down to 1 with 3 different
configure processing engines.   I have not seen apparmor patches that
bring it up to using the secure way of doing name based secuirty.
Could have missed it.

Smack and Selinux both have not contained name based because there was
no secure way todo it.  Due to Tomoyo teams work that has changed.  So
both Smack and Selinux really need to look at there position on
supporting name based.  I agree it would be a gain of Smack and
Selinux supported name based.

Major reason for not allowing multi-able LSM's is the risk that one
might interfere incorrectly with the others operation.  This is why
merging is fine.  Since the new method would have to be integrated at
development time into 1 LSM  so there could not be conflits.

Peter Dolding