Re: Linux Security *Module* Framework (Was: LSM conversion to static interface)

[Casey Schaufler <casey@schaufler-ca.com>]

--- Rob Meijer <capibara@xs4all.nl> wrote:


> >     * The proposal only allows a single implementation of each formal
> >       model. In theory, theory is just like practice, but in practice it
> >       is not. SMACK and SELinux follow substantially similar formal
> >       models (not exactly the same) so should we exclude one and keep
> >       the other? No, of course not, because in practice they are very
> >       different.
> 
> I would think the two may benefit from a role as described above.
> But I was thinking more in the line of new modules that may again
> implement this same model, and would thus benefit from interaction with
> this 'model maintainer' role.

The Smack development has benefited greatly from comments, suggestions,
and bug reports from members of the SELinux community. Further, I have
had no trouble whatever sharing the netlabel component with SELinux.
Audit is another matter as it requires some work to get the SELinux
dependencies out, but everyone's been receptive to proposals there.
Why on earth would I want some 'model maintainer' passing judgements
on my work in progress? The only thing I can imagine a 'model
maintainer' doing is obstructing innovation. Unless it was me, of
course. Linus is right, you know.


Casey Schaufler
casey@schaufler-ca.com