On Tue, Aug 5, 2008 at 1:58 PM, Cliffe <cliffe@ii.net> wrote:
Sorry to say stacking support really does need to be taken with a grain of salt.
Deeper the stack worse the issue of creating system lag.
Anti-malware stacking into LSM adding there own hooks need to be
looked at as more of a problem than a solution.
Lets take a simple example of Dazuko. It catches all filesystem
accesses and can alter them. Side effect all protected documents by
the LSM could end up going threw Dazuko so if a flaw is in the anti
virus that can be exploited straight up complete system exposed.
So really LSM stacking is not the correct solution. More correct
solution would be list out what features malware and virus scanners
need and extend LSM interfaces so the main LSM could control where the
antivirus/malware scanner was accessing. Yes there are times you
don't want virus scanners or malware scanners seeing everything.
Containers is another issue around stacking. Containers being added
to Linux are providing more and more controls. Currently LSM's are
independent to this. People have responded that it is light weight
virtualisation so dones not need the need to run a different LSM
secuirty construct inside a container. Its that it is
virtualistation is why it kinda need to.
Now any stacking design of LSM's have to take into account the needs
of containers.
Of course prefered is no stacking for containers and some form of
cross LSM mapping. Like prime kernel LSM being selinux, OS contained
being smack so smack secuirty files coveted to selinux with host OS's
limitations applied so container maintains its secuirty.
Same could be applied to chroot's. This is a common over site of the
current LSM model. chroot or containers running different
distrobution inside there is no preformated way of picking up the
secuirty. Note could even be the same distrubtion different version
just at one point of time they changed secuirty systems. So user is
running a chroot or a container to run a old application that is
needed. But now its running without secuirty. This is could become
a major issue in time.
So yes needs of stacking have some major headaches. Its not just a
malware issue.
Peter Dolding
--
