Good question. I keep tripping over the LSM hooks, and I have the
distinct impression that part of the current contention and lack of
agreement is simply the way things are current factored. So I'm
putting for a constructive suggestion that has the possibility of
going somewhere.
I'm looking towards this yes. There are times when we deliberately
allow mixing of things by the definition of what namespaces are and
there are some use cases where people don't want this.
No. I'm not even worrying about the user namespace until it resembles
complete. Currently I just view it as a stub because as is, the
security namespace is pretty much useless for any case I think about.
We still have way to many cases where the kernel treats different
names as the same name.
Well. I'm trying to make the LSM more useful to hack on and configure,
and much less contentions for ordinary people to use.
There is one issue with sockets that has come up where there are
people who really want to filter things at connect and bind time.
The LSM is so inflexible the only sane suggestion at the time was
to duplicate the LSM hooks and add an new iptable style table
for making that decision.
Also I'm thinking towards what do we have to do isolate the security
module stuff in the context of a namespace. So that a person in
a container can setup their own rules that further restrict the
system.
So far I'm not ready to do anything yet but I'm keeping a weather eye
on the situation so I have a clue what I'm go.
Thanks that sounds interesting.
I don't want to have to choose my LSM at compile time. I want to
add support into the kernel at compile time and be able to configure
it before I go multi-user. I know this kind of architecture is
achievable because iptables allows it.
When I conceive as the security modules as just a firewall between
applications on my own box I think, oh yeah this is no big deal,
I might want to limit something that way some time. These are just
some additional rules on when to return -EPERM. So I ask myself why
is this situation much less flexible and much harder to use then our
network firewall code?
Ok. Interesting. Are these kernel modules?
Still while I get the general impression that selinux seems to be
very close to a generic solution, and that selinux more or less has
the architecture we might want. I don't get the impression that
selinux does this at a level that is open to other people doing
interesting things.
So I still ask the question can we move this functionality down to
the LSM in a way that will solve the composition problem between
multiple security modules?
It really seems to me that the LSM as currently structured creates
a large barrier to entry for people who have just this little thing
they want to do that is not possible with any existing security
module.
Eric
-
