Re: [PATCH 0/4] MultiAdmin LSM

James Morris
2006-05-02T04:22:50Z

This module implements two distinct ideas:

(1) Multiple superusers with distinct UIDs.

More than one root on a system I think is generally regarded as a bad
idea. I'm not sure why you'd use a scheme like this instead of, say, sudo
or custom setuid helpers for specific tasks -- whatever the case, I think
such issues can be addressed entirely in userspace.

(2) Partially decomposing the superuser and protecting some users from
some decomposed superusers, and decomposing CAP_SYS_ADMIN.

This is a special-case security policy hard-coded into the kernel. It
lacks a clear design rationale, and does not seem amenable to analysis, as
its access control coverage is incomplete.

As already suggested, it may be worth looking at just decomposing
CAP_SYS_ADMIN, although it's not clear how do to this correctly for the
general case.

- James
--
James Morris
<jmorris@namei.org>