--- "Eric W. Biederman" <ebiederm@xmission.com> wrote:You start getting into some pretty serious mindset battles on this particular road. For starters, the "hooks" have to be authoritative if you want them properly switchable, and I'm not going to show you the scars I got the last time I proposed authoritative hooks. Next you'll have to deal with defining what is security behavior and what isn't. You wouldn't believe the debates over the security implications, or lack thereof, of disk quotas. Unless you're willing to take the approach that every conditional in the kernel is a potential security checkpoint you are going to miss someone's requirement and if you're willing to propose that, well, let's just say that Linus was right about security people. The API issue cannot be solved if LSMs are going to implement different behaviors. A reasonable subset can be addressed using the POSIX P1003.1e/2c MAC definition plus the TSIG APIs. It is unfortunate that SELinux has gone in a completely different direction. A specific table configuration sounds an awful lot like a specific SELinux Policy. Either way, your configuration is going to be large and may not implement anything rational. In addition to tools, there's the labor and money intensive Common Criteria Evaluation Process. Casey Schaufler casey@schaufler-ca.com -
| Fernando Luis | [PATCH] affinity is not defined in non-smp kernels - x86_64 |
| monstr | [PATCH 52/60] microblaze_v4: fcntl.h sockios.h ucontext.h |
| Roland Dreier | Re: Integration of SCST in the mainstream Linux kernel |
| Greg KH | [PATCH] Input: add appleir USB driver |
git: | |
| Shawn O. Pearce | Re: .gitlink for Summer of Code |
| Linus Torvalds | Re: What's in git.git (stable), and Announcing GIT 1.4.4.3 |
| Josh Boyer | git-unpack-objects |
| Jakub Narebski | Re: Git User's Survey 2007 unfinished summary continued |
| Richard Stallman | Real men don't attack straw men |
| Henning Brauer | Re: About Xen: maybe a reiterative question but .. |
| sonjaya | openvpn on openbsd 4.1 |
| Stefan Beke | mail dovecot: pipe() failed: Too many open files |
| Indan Zupancic | Re: Realtek 8111C transmit timed out |
| Julius Volz | [PATCHv3 21/24] IPVS: Add function to determine if IPv6 address is local |
| KOSAKI Motohiro | [bug?] tg3: Failed to load firmware "tigon/tg3_tso.bin" |
| Ilpo Järvinen | Re: [bug] stuck localhost TCP connections, v2.6.26-rc3+ |
