linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Lorenzo Hernández García-Hierro" <lorenzo@gnu.org>
To: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-security-module@wirex.com"
	<linux-security-module@wirex.com>
Cc: alan@redhat.com
Subject: Possible user base and mainline inclusion of LSM-based security improvements.
Date: Sun, 09 Jan 2005 20:42:53 +0100	[thread overview]
Message-ID: <1105299774.8662.13.camel@localhost.localdomain> (raw)

[-- Attachment #1: Type: text/plain, Size: 1925 bytes --]

Hi,

I'm now writing a "safe networking" LSM, inspired by grSecurity socket
restriction capabilities.

Currently, it provides users and groups (uid and gid based) Access
Control Lists, which can be changed in runtime by a new interface based
on my other LSM, the TPE, which registers a subsystem in sysfs and
creates  the needed entries for "realtime" configuration under secfs in
the mountpoint of sysfs (normally /sys/).

I'ts intended to provide a base of enhanced features inspired by the
well-designed grSecurity patch maintained and developed by Brad Spengler
(a.k.a. spender), by now i have the TPE and this LSM almost done.

The main goal is to provide an also well-designed (as most as possible)
security improvement using the LSM framework for Vanilla sources.

The main problem is that people often needs security enhancements that
they can not get by using the default Vanilla sources, even in an easy,
"user friendly" way.

What's more simple than insmod'ding a module?

Maybe the LSM framework is not the best one, or it's just not reliable
for this as some people and colectives said before, but i want to give
it a chance, even if this work could be nonsense for some people, it's
also for my own fun and coding profit.

If someone wants to help with this idea (i can not call it a project but
seems going to be :) ), just tell me.

Also, i would appreciate knowing the opinion from both kernel hackers
and users "vocal" base, about the inclusion of this security
improvements in the main line.

Tomorrow, my school time will start again after these Christmas
holidays, so, i will have more limited time and less nights (umm, none
maybe) to work on this stuff, until i get spin_unlock()'ed again ;).

Thanks in advance, cheers.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> [1024D/6F2B2DEC]
[2048g/9AE91A22] Hardened Debian head developer & project manager

[-- Attachment #2: Esta parte del mensaje está firmada digitalmente --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

                 reply	other threads:[~2005-01-09 19:44 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1105299774.8662.13.camel@localhost.localdomain \
    --to=lorenzo@gnu.org \
    --cc=alan@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@wirex.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).