Re: [Xense-devel][RFC][PATCH][0/4] Xen Security Modules: Intro

[Robert Watson <robert@fledge.watson.org>]

On Fri, 1 Sep 2006, Chris Wright wrote:

>> - LSM has a problem of not supporting stacking module, and that is really 
>> paint in the arse. How about XSM? Do you try to fix that problem?
>
> I don't see anything in XSM that changes that limitation to LSM.  In fact, 
> it appears to not even support the very weak stacking via chaining mechanism 
> (which is a good plan in this case).  And it's questionable at best. 
> Arbitrary security policies simply do not compose.

I'm not entirely convinced that the theoretically hard problem of arbitrary 
policy composition is that much of a problem in practice.  A number of systems 
(RSBAC on Linux, kauth(9) on Mac OS X, the MAC Framework on FreeBSD and Mac OS 
X, and the fixed compositions of MAC policies in many trusted systems) have 
illustrated that you can do a lot of useful things using a fixed composition 
that is effectively a logical and of granted rights.  That isn't the same as 
stacking, of course, since the composition happens in the containing 
framework, rather than in the policies.  Obviously, there are limitations to 
this approach, but for many things, it works quite well in quite a few 
deployed real-world systems with moderately diverse policies.

Robert N M Watson
Computer Laboratory
University of Cambridge