Quoting Nix ([email protected]):
> On 23 Apr 2006, Ulrich Drepper prattled cheerily:
> > On 4/23/06, Arjan van de Ven <[email protected]> wrote:
> >> does this also prevent people writing their own elf loader in a bit of
> >> perl and just mmap the code ?
> >
> > You will never get 100% protection from a mechanism like signed
> > binaries. What you can get in collaboration with other protections
> > like SELinux is another layer of security. That's good IMO. Not
> > being able to slide in modified and substituted binaries which then
> > would be marked to get certain privileges is a plus.
>
> Of course in order to use it in conjunction with SELinux right now you
> need LSM stacking, which is a nest of dragons in itself (if not used
> very carefully stacking can weaken security rather than strengthening
> it...)
Perhaps. On the other hand, combining selinux with digsig you get:
1. selinux integrity controls on crucial digsig files, which
digsig does not (and should not) protect itself
2. digsig controls over selinux entry types. So now you can
protect domain transitions with small, verifiable entry points
which are then signed to boot.
> `Stripped-down firewalls' on its own is a big niche.
Every home should have one.
> Combine it with SELinux, exec-shield, FORTIFY_SOURCE, -fstack-protector
> and, say, a COWed filesystem read off a CD and reset with every boot,
> and you start to get a bit less insecure than you would otherwise be.
Sounds like a good basis for a new tiny distro.
-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
