grsecurity in 2.5?

grsecurity in 2.5?

[Zoltan NAGY]

hi!

its a simple question.. it there a chance that grsecurity will be (even 
partially) merged into 2.5?

thanks

Zoltan NAGY
Nefty WebStudio

Re: grsecurity in 2.5?

[Greg KH]

On Sun, Apr 20, 2003 at 10:23:01AM +0200, Zoltan NAGY wrote:
> hi!
> 
> its a simple question.. it there a chance that grsecurity will be (even 
> partially) merged into 2.5?

What's the status of that patch being ported to the LSM interface (which
is already in 2.5)?

thanks,

greg k-h

Re: grsecurity in 2.5?

[Zoltan NAGY]

On Mon, 21 Apr 2003, Greg KH wrote:

> On Sun, Apr 20, 2003 at 10:23:01AM +0200, Zoltan NAGY wrote:
> > hi!
> > 
> > its a simple question.. it there a chance that grsecurity will be (even 
> > partially) merged into 2.5?
> 
> What's the status of that patch being ported to the LSM interface (which
> is already in 2.5)?

AFAIK there was a discussion about it, but i dont know what decision has 
born.. 

Re: grsecurity in 2.5?

[Chris Wright]

* Zoltan NAGY (nagyz@piarista-kkt.sulinet.hu) wrote:
> On Mon, 21 Apr 2003, Greg KH wrote:
> 
> > What's the status of that patch being ported to the LSM interface (which
> > is already in 2.5)?
> 
> AFAIK there was a discussion about it, but i dont know what decision has 
> born.. 

I don't think the grsecurity developers are motivated to port their work
to LSM.  Patches are welcome of course ;-)

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

Re: grsecurity in 2.5?

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 661 bytes --]

On Mon, 21 Apr 2003 23:37:38 +0200, Zoltan NAGY said:
> On Mon, 21 Apr 2003, Greg KH wrote:
> 
> > On Sun, Apr 20, 2003 at 10:23:01AM +0200, Zoltan NAGY wrote:
> > > hi!
> > > 
> > > its a simple question.. it there a chance that grsecurity will be (even 
> > > partially) merged into 2.5?
> > 
> > What's the status of that patch being ported to the LSM interface (which
> > is already in 2.5)?
> 
> AFAIK there was a discussion about it, but i dont know what decision has 
> born.. 

Some parts of grsecurity were trivial to fit into the LSM framework.  Other
parts are basically impossible simply because LSM doesn't hook into the
code where it's needed....

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: grsecurity in 2.5?

[Chris Wright]

* Valdis.Kletnieks@vt.edu (Valdis.Kletnieks@vt.edu) wrote:
> On Mon, 21 Apr 2003 23:37:38 +0200, Zoltan NAGY said:
> > On Mon, 21 Apr 2003, Greg KH wrote:
> > > What's the status of that patch being ported to the LSM interface (which
> > > is already in 2.5)?
> > 
> > AFAIK there was a discussion about it, but i dont know what decision has 
> > born.. 
> 
> Some parts of grsecurity were trivial to fit into the LSM framework.  Other
> parts are basically impossible simply because LSM doesn't hook into the
> code where it's needed....

Yes, hence the lack of motivation to bring over just the portable parts.
 
thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

Re: grsecurity in 2.5?

[Grzegorz Jaskiewicz]

On Mon, 2003-04-21 at 22:38, Chris Wright wrote:
> * Zoltan NAGY (nagyz@piarista-kkt.sulinet.hu) wrote:
> > On Mon, 21 Apr 2003, Greg KH wrote:
> > 
> > > What's the status of that patch being ported to the LSM interface (which
> > > is already in 2.5)?
> > 
> > AFAIK there was a discussion about it, but i dont know what decision has 
> > born.. 
> 
> I don't think the grsecurity developers are motivated to port their work
> to LSM.  Patches are welcome of course ;-)
Maybe we should start to bring them piece by piece, fe. PaX first and
others. 
Question is not that will somebody do that, i am sure of that - grsec is
needed in 2.4 - and it will be needed in 2.6. Question is, if it will be
included in mainstream kernel release ?

-- 
Grzegorz Jaskiewicz <gj@pointblue.com.pl>
K4 labs

Re: grsecurity in 2.5?

[Chris Wright]

* Grzegorz Jaskiewicz (gj@pointblue.com.pl) wrote:

> Maybe we should start to bring them piece by piece, fe. PaX first and
> others. 

PaX is an example of something that won't port to LSM.  The grsecurity
MAC, RBAC, chroot restrictions, TPE are the types of things that would port
nicely.

> Question is not that will somebody do that, i am sure of that - grsec is
> needed in 2.4 - and it will be needed in 2.6. Question is, if it will be
> included in mainstream kernel release ?

I don't expect to see it in 2.6 mainline at all.  The patch could be
reduced if some of the core access control logic was placed in an LSM.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net