Re: [PATCH] ptrace: allow restriction of ptrace scope

Kees Cook
2010-06-18T17:59:21Z

Hi,

On Thu, Jun 17, 2010 at 11:30:54PM +0100, Alan Cox wrote:
> - You can give up now.

Failure is always an option! :) Nah, I was never deluded into thinking
these patches were going to be universally-loved and easy to upstream.
I posted them because I want them in, and I'm going to stick with it.

> - You can put it together as a security module - which will make people
> happy and get your stuff upstream. After that you can have a meaningful
> discussion about stacking, although I think you'll find that stacking
> is really really hard because you get conflicting behaviour between
> security modules and ignoring those conflicts ends up violating at least
> one of the security models leaving you worse not better off.
>
> Your path to making any of the stuff you want happen is via the security
> layer and the LSM hooks. Even if you want them stackable and usable with
> other modules your starting point is still a security module.

Sounds like this really is the only path, with the idea of finding a
chaining solution later. Without chaining, it's only useful for people
that aren't using a full MAC.

-Kees

--
Kees Cook
Ubuntu Security Team