Messages in this thread |  | | Date | Tue, 8 Jan 2013 10:38:59 +0400 | From | Vasily Kulikov <> | Subject | Re: [PATCH v12 0/9] LSM: Multiple concurrent LSMs |
| |
On Mon, Jan 07, 2013 at 20:02 -0800, Casey Schaufler wrote: > On 1/7/2013 7:01 PM, Stephen Rothwell wrote: > > Let me ask Andrew's question: Why do you want to do this (what is the > > use case)? What does this gain us? > > There has been an amazing amount of development in system security > over the past three years. Almost none of it has been in the kernel. > One important reason that it is not getting done in the kernel is > that the current single LSM restriction requires an all or nothing > approach to security. Either you address all your needs with a single > LSM or you have to go with a user space solution, in which case you > may as well do everything in user space. [...]
You should also update Documentation/security/LSM.txt with new "security=" rules and rules of LSM stacking limitations. Motivation of stacking is probably worth noting in Documentation/ too.
Thanks,
-- Vasily Kulikov http://www.openwall.com - bringing security into open computing environments
|  |