lkml.org 
[lkml]   [2004]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: secure computing for 2.6.7
    Tue, Aug 03, 2004 at 08:40:45AM -0400, Stephen Smalley wrote:
    > On Wed, 2004-07-07 at 15:27, Hans Reiser wrote:
    > > Am I right to think that this could complement nicely our plans
    > > described at www.namesys.com/blackbox_security.html
    > Hi Hans,
    >
    > Out of curiosity, what do you think that this proposal will achieve that
    > cannot already be done via SELinux policy? SELinux policy can already
    > express access rules based not only on the executable and user, but even
    > the entire call chain that led to a given executable.

    convinience ? speed ?


    RBAC is a Good Thing, but I wonder if it could provide throughout syntax analysis
    for vfs related syscalls. As it is now.

    At least what declared in their docs, fs-wise they are somewhat like this

    Macro Name Description
    stat_file_perms Permissions to call stat or access on a file.
    x_file_perms Permissions to execute a file.
    r_file_perms Permissions to read a file.
    rx_file_perms Permissions to read and execute a file.
    rw_file_perms Permissions to read and write a file.
    ra_file_perms Permissions to read and append to a file.
    link_file_perms Permissions to link, unlink, or rename a file.
    create_file_perms Permissions to create, access, and delete a file.
    r_dir_perms Permissions to read and search a directory.
    rw_dir_perms Permissions to read and modify a directory.
    ra_dir_perms Permissions to read and add entries to a directory.
    create_dir_perms Permissions to create, access, and delete a directory.
    mount_fs_perms Permissions to mount and unmount a filesystem.


    *shrugs*
    Well, I am probably wrong...

    p.s. _AND_ if I remember correctly reiser4 supposed to provide finer-then-file grain security.
    well, at least it easily could, being truly semantic-enabled fs.

    --
    "the liberation loophole will make it clear.."
    lex lyamin
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:04    [W:3.680 / U:1.480 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site