Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks

Serge E. Hallyn
2006-04-18T20:36:58Z

Quoting Stephen Smalley (sds@tycho.nsa.gov):
> On Tue, 2006-04-18 at 14:59 -0500, Serge E. Hallyn wrote:
> > Quoting Alan Cox (alan@lxorguk.ukuu.org.uk):
> > > On Maw, 2006-04-18 at 09:50 -0700, Gerrit Huizenga wrote:
> > > > or are there places where a "less than perfect, easy to use, good enough"
> > > > security policy? I believe there is room for both based on the end
> > > > users' needs and desires. But that is just my opinion.
> > >
> > > Poor security systems lead to less security than no security because it
> > > lulls people into a false sense of security. Someone who knows their
> >
> > Not wanting to make any digs one way or another, but because the culture
> > right now refuses to admit it I must point out:
> >
> > So does "security" which is too complicated and therefore ends up
> > misconfigured (or disabled).
>
> Not sure who refuses to admit it, but there is plenty of work in
> progress to improve SELinux useability. But that doesn't require

Yes, absolutely, some very good work.

I used to think I'd want selinux protecting the TCB, but worried about
user customizations threatening the integrity of the TCB policy. But
the namespace extension (.) may even allay that fear.

-serge