RE: FW: Current/Future Plans to Support Stacking LSM Modules

["Tom Fortmann" <tfortmann@xcapesolutions.net>]

Stephen,

Thank you for the links.  I obviously have a lot more research to do, first
and foremost is the selinux_register_security function.  I will also dig in
to the SELinux Type Enforcement capabilities.  We are not averse to doing
this in either space, but user space does offer some benefits from a
maintenance point of view.

Thomas Fortmann
Sr. Software Engineer

-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov] 
Sent: Tuesday, January 16, 2007 1:52 PM
To: Tom Fortmann
Cc: selinux@tycho.nsa.gov
Subject: Re: FW: Current/Future Plans to Support Stacking LSM Modules

On Tue, 2007-01-16 at 13:41 -0600, Tom Fortmann wrote:
> Can you send me a pointer to the limited stacking that selinux supports?

http://www.nsa.gov/selinux/papers/module/x341.html

> I will join the LSM list.  I started here because LSM already supports a
> basic stacking method.  However, SELinux does not support the
> mod_reg_security call necessary to take advantage of this capability.  

No, SELinux does support trivial stacking by implementing a
register_security hook, which is what mod_reg_security() calls.  That is
used to combine SELinux with the Linux capabilities module.

> The product we are developing adds additional security at the application
> data layer.  It is a commercial product so I can't say a lot, other then
to
> say that SELinux currently does not provide the additional features we are
> working on.

If you are adding additional security at the application data layer,
then you can do that in userspace, and use to
make it unbypassable and tamperproof.  You don't need to change the
kernel.

-- 
Stephen Smalley
National Security Agency



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.