Re: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks)

[Arjan van de Ven <arjan@infradead.org>]

On Mon, 2006-04-24 at 08:09 -0500, Serge E. Hallyn wrote:
> Quoting Arjan van de Ven (arjan@infradead.org):
> > for all such things in the first place. In fact, we already know that to
> > do auditing, LSM is the wrong thing to do (and that's why audit doesn't
> > use LSM). It's one of those fundamental linux truths: Trying to be
> 
> As I recall it was simply decided that LSM must be "access control
> only", and that was why it wasn't used for audit.

no you recall incorrectly.
Audit needs to audit things that didn't work out, like filenames that
don't exist. Audit needs to know what is going to happen before the
entire "is this allowed" chain is going to be followed. SELInux and
other LSM parts are just one part of that chain, and there's zero
guarantee that you get to the LSM part in the chain.....  Now of course
you could add hooks at places where audit puts them now, and call those
"LSM" but that'd just be artificial, pointless and bad design.


> Didn't Linda Walsh claim a much faster audit implementation using LSM
> than the current lightweight audit framework?

People can claim the world; the problem is that you can't make a tight
audit with LSM because of all the namespace issues (AppArmor can evade
those by locking stuff down, audit obviously cannot). So I highly doubt
the validity of such claim.
Audit also HAS to tie into some other places to avoid having to
double-copy on the userspace filename data, at which point you're not
really using LSM, you're just hijacking some of it's hooks.
[and you have to avoid such double copy for your audit to be reliable
enough to mean something]

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/