Re: [PATCH v4 2/14] Add TSEM specific documentation.

Casey Schaufler
2025-02-25T15:58:51Z

On 2/25/2025 4:01 AM, Dr. Greg wrote:
> On Tue, Jan 28, 2025 at 05:23:52PM -0500, Paul Moore wrote:
>
> For the record, further documentation of our replies to TSEM technical
> issues.
>
> ...
>
> Further, TSEM is formulated on the premise that software teams,
> as a by product of CI/CD automation and testing, can develop precise
> descriptions of the security behavior of their workloads.

I've said it before, and I'll say it again. This premise is hopelessly
naive. If it was workable you'd be able to use SELinux and audit2allow
to create perfect security, and it would have been done 15 years ago.
The whole idea that you can glean what a software system is *supposed*
to do from what it *does* flies completely in the face of basic security
principles.