Implementing a Linux Security Module

Implementing a Linux Security Module

[d.capitella]

Hi there! I'm studying the Linux Security Module Framework, and I'm
experiencing some issues while trying to register the modules I create.

I created a basic test module that just registers itself as a lsm. I
tried to load it on many distros, Ubuntu, Fedora, RedHat but it is not
allowed to register. 

May this be due to other LSMs that doesn't 
support stacking and that are
already loaded on those distros? If 
that's the problem, can't we just
create a security module that does 
nothing but managing the stacking of
other security modules?

Thanks,
Donato Capitella

Re: Implementing a Linux Security Module

[Casey Schaufler]

--- "d.capitella@tin.it" <d.capitella@tin.it> wrote:

> Hi there! I'm studying the Linux Security Module Framework, and I'm
> experiencing some issues while trying to register the modules I create.
> 
> I created a basic test module that just registers itself as a lsm. I
> tried to load it on many distros, Ubuntu, Fedora, RedHat but it is not
> allowed to register. 
> 
> May this be due to other LSMs that doesn't 
> support stacking and that are
> already loaded on those distros? If 
> that's the problem, can't we just
> create a security module that does 
> nothing but managing the stacking of
> other security modules?

Yes, that is an option.

There was work on a stacking module early on, but the
lack of available modules and some of the stickier interaction
issues lead to it being set aside.

It certainly makes sense to stack a time-clock access
module and a physical location module. It would not
make sense to stack SELinux and ... well, anything.

What you need to do in the current environment is build your
own kernel, not just the module. It takes more time, disk,
and cpu, but that's about it.


Casey Schaufler
casey@schaufler-ca.com