Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks

Stephen Smalley
2006-04-17T19:58:21Z

On Mon, 2006-04-17 at 14:47 -0500, Serge E. Hallyn wrote:
> Quoting James Morris (jmorris@namei.org):
> > Last I recall on this issue, we asked if you could look at providing
> > integrity measurement as a distinct API, and integrity control as either
> > integrated with SELinux or a distinct component which SELinux could use.
>
> And those are what I believe the next patchset will provide.

At the conclusion of the last round of discussions on slim-evm-ima on
list, it was the case that:
- ima was no longer an issue, as it had already ceased being a separate
LSM,
- it was demonstrated that evm needed to be tightly coupled with any LSM
in order to work correctly and efficiently, and it seemed to be accepted
that evm needed to be turned from a separate LSM into a set of support
functions for use by a LSM (as well as having many other design and
implementation problems to resolve to be truly useable),
- it was argued that slim was broken-by-design and no one was willing or
able to refute that position.

Hardly a strong case for LSM...

--
Stephen Smalley
National Security Agency