Re: thoughts on kernel security issues

[John Richard Moser <nigelenki@comcast.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Valdis.Kletnieks@vt.edu wrote:
> On Wed, 19 Jan 2005 15:12:05 EST, John Richard Moser said:
> 
> 
>>>And why were they merged?  Because they showed up in 4-8K chunks.
> 
> 
>>so you want 90-200 split out patches for GrSecurity?
> 
> 
> Even better would be a 30-40 patch train for PaX, a 10-15 patch train
> for the other randomization stuff in grsecurity (pid, port number, all
> the rest of those), a 50-60 patch train for the RBAC stuff, and so on.
> 

RBAC first.  Some of the other stuff relies on the RBAC system, I'm
told.  Not sure what.

> Keep in mind that properly segmented, *parts* of grsecurity have at least
> a fighting chance - the fact that (for instance) mainline may reject the
> way RBAC is implemented because it's not LSM-based doesn't mean that you
> shouldn't at least try to get the PaX stuff in, and the randomization stuff,
> and so on.
> 

I think GrSecurity's RBAC is a bit bigger than LSM can accomodate.

Anyway, I wasn't originally trying to get PaX into mainline in this
discussion; I think this started out with me trying to point out why
things like PaX have to be all-or-nothing.

> 

- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFB7ssKhDd4aOud5P8RAnVtAJ9f4YcAjLOEGkG7NOB7TBqJdnXD5QCfXwyZ
ozuM56ETWpuOAvKUgXkmJrA=
=+Hnj
-----END PGP SIGNATURE-----