| |||||||||||||
Complete coverage in Linux security modulesComplete coverage in Linux security modulesPosted Oct 6, 2005 8:56 UTC (Thu) by dps (subscriber, #5725)Parent article: Complete coverage in Linux security modules
It might be worth looking at building the security controls "deeper" into the kernel. If read() and readv() both end up calling something and the security conrol could be placed there then it would be more resistant to implementation changes. Of course it might be than by then you have lost important context information, so that strategy will not work.
I could see possible value in restricting rewriting the boot block in the block layer. Doing this would cover mmap/msync, write, writev, asyncheonous I/O and anything else I might have missed. I am not volunteering do this right now.
(Log in to post comments)
|
|||||||||||||