Re: [PATCH] Realtime LSM

[Chris Wright <chrisw@osdl.org>]

* Lee Revell (rlrevell@joe-job.com) wrote:
> On Fri, 2004-10-01 at 17:23, Chris Wright wrote:
> > It's nice to have something that's easy to use, but that's not a great
> > justification for addition to the kernel.  Esp. when there's a
> > functional userspace solution.
> 
> OK, poor choice of words.  Correctness of course comes before ease of
> use.  I believe the realtime-lsm module satisfies both requirements.

I agree with that.  That's not my objection.  It's about pushing code
(albeit it's small and non-invasive) into the kernel that can be done in
userspace, that's all.

> > > The ulimit approach would probably be acceptable
> > > if it subsumed all the functionality of the realtime-lsm module.
> > 
> > Hrm, I guess we'll have to agree to disagree.  The whole point of the
> > mlock rlimits code is to enable this policy to be pushed to userspace.
> > A generic method of enabling capabilities is the best way to go, long
> > term.  Any interest in pursuing that?
> 
> I did not mean to imply that I disagree with the realtime-lsm approach. 
> Obviously some kernel support is required, and realtime-lsm seems to
> solve the problem with the minimum possible change to the kernel.  And
> above all it is a proven working solution that has been field tested for
> months by many, many users.

Clearly it's useful for the audio folks.  Whether it's the right thing
to go into the kernel is all that's in question here.  Do we agree it's
a stopgap measure making up for lack of a better general solution?

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net