Re: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks)

Jan Engelhardt
2006-04-19T19:08:12Z

>>
>> Well then, have a look at http://alphagate.hopto.org/multiadm/
>>
>
>hmm on first sight that seems to be basically an extension to the
>existing capability() code... rather than a 'real' LSM module. Am I
>missing something here?
>

(So what's the definition for a "real" LSM module?)

It's quite a "big" extension to the capability code inasfar as that
access is not solely granted based on capabilities, but a matrix of
capabilities plus UID/GID of filesystem objects.

This is not a "for fun" LSM like rootplug, but it was specifically
developed to address some permission issues in an educational institution.
The LSM hooks were there (and some more are added with MultiAdm), and it
seemed a lot simpler than setting up SELinux.

Jan Engelhardt
--