From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzdrum.ncsc.mil (zombie.ncsc.mil [144.51.88.131]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id l0GKUOLb023469 for ; Tue, 16 Jan 2007 15:30:24 -0500 Received: from host496.ipowerweb.com (jazzdrum.ncsc.mil [144.51.5.7]) by jazzdrum.ncsc.mil (8.12.10/8.12.10) with SMTP id l0GKVGAN017639 for ; Tue, 16 Jan 2007 20:31:17 GMT From: "Tom Fortmann" To: "'Stephen Smalley'" Cc: References: <003801c739a6$461871f0$030a0a0a@ACER> <1168977133.22731.149.camel@moss-spartans.epoch.ncsc.mil> Subject: RE: FW: Current/Future Plans to Support Stacking LSM Modules Date: Tue, 16 Jan 2007 14:31:31 -0600 Message-ID: <003c01c739ad$4ead63a0$030a0a0a@ACER> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" In-Reply-To: <1168977133.22731.149.camel@moss-spartans.epoch.ncsc.mil> Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov Stephen, Thank you for the links. I obviously have a lot more research to do, first and foremost is the selinux_register_security function. I will also dig in to the SELinux Type Enforcement capabilities. We are not averse to doing this in either space, but user space does offer some benefits from a maintenance point of view. Thomas Fortmann Sr. Software Engineer -----Original Message----- From: Stephen Smalley [mailto:sds@tycho.nsa.gov] Sent: Tuesday, January 16, 2007 1:52 PM To: Tom Fortmann Cc: selinux@tycho.nsa.gov Subject: Re: FW: Current/Future Plans to Support Stacking LSM Modules On Tue, 2007-01-16 at 13:41 -0600, Tom Fortmann wrote: > Can you send me a pointer to the limited stacking that selinux supports? http://www.nsa.gov/selinux/papers/module/x341.html > I will join the LSM list. I started here because LSM already supports a > basic stacking method. However, SELinux does not support the > mod_reg_security call necessary to take advantage of this capability. No, SELinux does support trivial stacking by implementing a register_security hook, which is what mod_reg_security() calls. That is used to combine SELinux with the Linux capabilities module. > The product we are developing adds additional security at the application > data layer. It is a commercial product so I can't say a lot, other then to > say that SELinux currently does not provide the additional features we are > working on. If you are adding additional security at the application data layer, then you can do that in userspace, and use to make it unbypassable and tamperproof. You don't need to change the kernel. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.