Re: LSM conversion to static interface

[Giacomo Catenazzi <cate@debian.org>]

Thomas Fricaccia wrote:
> Some well-respected contributors have taken exception my amplification
> of Crispin Cowan's point about the patch that closes LSM.
> 
> Crispin Cowan <crispin@crispincowan.com> wrote:
>>     * It prevents enterprise users, and in fact anyone who isn't
>>       comfortable compiling their own kernel, from ever trying out any
>>       security module that their distro vendor of choice did not ship.
> 
> I extended this point by observing that regulatory laws make it difficult
> for enterprise customers to compile their own kernels, mentioning one
> of the more invasive statutes, Sarbanes-Oxley.
> 
> In reply, "Alan Cox" <alan@lxorguk.ukuu.org.uk> writes:
>> Crispin at least is providing genuine discussion points. Sarbox has
>> nothing to say on "using vendor linux kernels".
> 
> And just previously, "Greg KH" <greg@kroah.com> had written:
>> Since when does Sarbanes-Oxley decree that a company must use a
>> "standard kernel"?  And just exactly what defines such "standard
>> kernel"?  Can you point out where in that bill it requires such a
>> thing?
> 
> I was actually talking about the *effects* of regulatory law, rather
> than the wording in the text of the statutes.  The misunderstanding
> could be partially my fault, as my exact words were 
> 
>    As Sarbanes-Oxley and other regulatory laws require these
>    customers to use "standard kernels" ....
> 
> which may not have been as unambiguously clear as I intended.
> 
> But as long as we're here, let me elaborate on the point I tried to make.
> 
> SOX and other laws require enterprise customers to keep specified
> controls on their internal processing procedures, and keep documentation
> that can be audited to prove compliance.  The auditing requirements
> are extensive and detailed, and certainly include the kernel of an
> operating system used to process business and/or financial transactions.
> 
> It is within this framework that enterprise customers conclude something
> like (and this is vernacular, not the language within the statutes) "if
> we use any kernel other than that supplied by our distributor, the
> SOX auditing paperwork will be a nightmare."  (I've actually heard
> statements similar to this, and so believe that it is an accurate
> portrayal of the perception of the effects of regulatory law.  I'm not
> a lawyer.)
> 
> As I said at the beginning, I meant to amplify Crispin's observation
> that enterprise customers are reluctant to compile their own kernels
> with the additional observation that the complexities of regulatory
> law create obstacles that are significant contributors to that reluctance.
> 
> I'll not belabor the unfortunate non sequitur further.  You can find
> plenty of documentation of auditing requirements with by Googling
> combinations of "Sarbanes-Oxley," "operating system integrity", etc.
> This is a big-business topic of wide concern.

What do technical and regulatory differences have "driver/LSM module" that
is build-in and one that is modular?
It seems to me silly to find difference.  A kernel with a new kernel module
is a new kernel.

ciao
	cate