Re: patch to make Linux capabilities into something useful (v 0.3.1)

[daw@cs.berkeley.edu (David Wagner)]

Casey Schaufler  wrote:
>In our TCSEC B1 (Old person speak for LSPP)
>evaluation we had to put way too much effort
>into explaining why certain operations that
>had nothing to do with the system security
>policy (e.g. compute resource limitations)
>required privilege. These operations had
>no security implications at all, but since
>they required privilege they were assumed to
>have dire consequences should they be abused.

Well, this is sounding like a pretty weak argument.

It sounds like what you are saying is the evaluators were not thinking
straight when they gave you a hard time about your efforts to do a
better job of implementing the principle of least privilege.  If I
understand the gist of what you are saying correctly, you reduced the
privilege on some processes, and the result was that they complained
more loudly than if you had done nothing.  If so, that's pretty lame.
That doesn't sound to me like the evaluators were thinking very clearly.

And if the evaluators don't really understand how to think clearly about
security, why should we pay any attention to them, anyway?  I see no
reason to design the Linux kernel around the whims of those who don't
understand the technical issues.  Who cares about what the evaluators
think, if they don't have their head screwed on straight?  Personally,
I care more about technical merit than about pleasing folks who don't
understand security.