From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Wright Subject: Re: [Xense-devel][RFC][PATCH][0/4] Xen Security Modules: Intro Date: Fri, 1 Sep 2006 12:09:49 -0700 Message-ID: <20060901190949.GQ10348@sequoia.sous-sol.org> References: <1157129851.22006.187.camel@moss-walleye.epoch.ncsc.mil> <20060901175832.GB21066@sequoia.sous-sol.org> <20060901191025.W18193@fledge.watson.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20060901191025.W18193@fledge.watson.org> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Robert Watson Cc: Chris Wright , xen-devel@lists.xensource.com, xense-devel@lists.xensource.com, Jun Koi List-Id: xen-devel@lists.xenproject.org * Robert Watson (robert@fledge.watson.org) wrote: > On Fri, 1 Sep 2006, Chris Wright wrote: > >I don't see anything in XSM that changes that limitation to LSM. In fact, > >it appears to not even support the very weak stacking via chaining > >mechanism (which is a good plan in this case). And it's questionable at > >best. Arbitrary security policies simply do not compose. > > I'm not entirely convinced that the theoretically hard problem of arbitrary > policy composition is that much of a problem in practice. A number of > systems (RSBAC on Linux, kauth(9) on Mac OS X, the MAC Framework on FreeBSD > and Mac OS X, and the fixed compositions of MAC policies in many trusted > systems) have illustrated that you can do a lot of useful things using a > fixed composition that is effectively a logical and of granted rights. > That isn't the same as stacking, of course, since the composition happens > in the containing framework, rather than in the policies. Obviously, there > are limitations to this approach, but for many things, it works quite well > in quite a few deployed real-world systems with moderately diverse policies. No argument that it's possible to create useful compositions, especially with framework imposed limitations like you mentioned. But the flask policy model is not the kind that I'd like to see composed with random other security models. thanks, -chris