Re: Implementing a Linux Security Module

[Casey Schaufler <casey@schaufler-ca.com>]

--- "d.capitella@tin.it" <d.capitella@tin.it> wrote:

> Hi there! I'm studying the Linux Security Module Framework, and I'm
> experiencing some issues while trying to register the modules I create.
> 
> I created a basic test module that just registers itself as a lsm. I
> tried to load it on many distros, Ubuntu, Fedora, RedHat but it is not
> allowed to register. 
> 
> May this be due to other LSMs that doesn't 
> support stacking and that are
> already loaded on those distros? If 
> that's the problem, can't we just
> create a security module that does 
> nothing but managing the stacking of
> other security modules?

Yes, that is an option.

There was work on a stacking module early on, but the
lack of available modules and some of the stickier interaction
issues lead to it being set aside.

It certainly makes sense to stack a time-clock access
module and a physical location module. It would not
make sense to stack SELinux and ... well, anything.

What you need to do in the current environment is build your
own kernel, not just the module. It takes more time, disk,
and cpu, but that's about it.


Casey Schaufler
casey@schaufler-ca.com