--- Joshua Brindle <[email protected]> wrote:
> Casey Schaufler wrote:
> > --- Joshua Brindle <[email protected]> wrote:
> >
> >>> The first system I took through evaluation
> >>> (that is, independent 3rd party analysis) stored
> >>> security attributes in a file while the second
> >>> and third systems attached the attributes
> >>> directly (XFS). The 1st evaluation required
> >>> 5 years, the 2nd 1 year. It is possible that
> >>> I just got a lot smarter with age, but I
> >>> ascribe a significant amount of the improvement
> >>> to the direct association of the attributes
> >>> to the file.
> >>>
> >> Thats great but entirely irrelevant in this
> context.
> >> The patch and caps
> >> in question are not attached to the file via some
> >> externally observable
> >> property (eg., xattr) but instead are embedded in
> >> the source code so
> >> that it can drop caps at certain points during
> the
> >> execution or before
> >> executing another app, thus unanalyzable.
> >>
> >
> > Oh that. Sure, we used capability bracketing
> > in the code, too. That makes it easy to
> > determine when a capability is active. What,
> > you don't think that it's possible to analyze
> > source code? Of course it is. Refer to the
> > evaluation reports if you don't believe me.
> >
> >
> When I see an analysis of every line of source code
> on an average Linux
> machine then I might believe you
Would an above average Unix system suffice?
How about MULTICS?
It's been done for:
Irix and Trusted Irix
Solaris and Trusted Solaris
UNICOS
HP/UX
AIX
SystemV
Xenix
> (if you'll grant
> that no software can
> ever be installed on it afterward without being
> analyzed)
Rubbish. No privileged software can be installed.
Software that runs as a user without capabilities
can be installed freely. It only requires analysis
if it violates policy, which on a system with
POSIX capabilities means running in possession
of capabilities.
> but until then
> I'll stick with a centralized policy.
OK. There is value in containment.
> I doubt many others will be
> satisfied with that limitation.
It's been selling in the marketplace for
the past 20 years.
> Bracketing hardly makes it analyzable, how can you
> possibly know if the
> bracketing happened?
Err, read the code?
> You *believe* it will and
> therefore you say that
> the bracketed code is safe but in reality this is a
> discretionary
> mechanism and you have zero assurance that there is
> any security whatsoever,
Ah, no. You don't seem to understand the concept.
> no thanks, I'll pass.
Probably just as well, all things considered.
Casey Schaufler
[email protected]
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
