Re: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks)

Pavel Machek
2006-04-24T18:21:35Z

On Wed 19-04-06 21:06:57, Jan Engelhardt wrote:
> >>
> >> Well then, have a look at http://alphagate.hopto.org/multiadm/
> >>
> >
> >hmm on first sight that seems to be basically an extension to the
> >existing capability() code... rather than a 'real' LSM module. Am I
> >missing something here?
> >
>
> (So what's the definition for a "real" LSM module?)
>
> It's quite a "big" extension to the capability code inasfar as that
> access is not solely granted based on capabilities, but a matrix of
> capabilities plus UID/GID of filesystem objects.
>
> This is not a "for fun" LSM like rootplug, but it was specifically
> developed to address some permission issues in an educational institution.
> The LSM hooks were there (and some more are added with MultiAdm), and it
> seemed a lot simpler than setting up SELinux.

Easier to setup does not seem like good reason for changing kernel,
I'm afraid. Surely selinux can be improved or
userland-educational-selinux created?
Pavel
--
Thanks, Sharp!