LWN: Comments on "Dazuko and the LSM API"

Third paragraph - nitpick

k8to — 2006-10-26T21:46:50+00:00

The third paragraph reads:

This lead the Dazuko developers in a direction that clearly will not fly with the kernel developers: system call hooking

It should read: "This led the..." I stumbled for a bit on this somehow. Maybe I'm just tired.

Dazuko and the LSM API

addw — 2006-10-26T21:38:07+00:00

System call hooking seems to be to be an excellent way for a bit of malware to hide itself ... make itself invisible to 'ps', etc.
I'm not sure that I would want that on my system.

Dazuko and the LSM API

jake — 2006-10-26T13:02:50+00:00

> Would anyone care to clarify (with pointers, if possible) the above?
> Especially IRT the "hostile attitude towards the suggested ways of moving
> their code into the tree", and which are those suggested ways?

I guess I might be in the best position to do that ...

http://dazuko.org/tgen.shtml#LSM
http://grsecurity.net/lsm.php
http://www.rsbac.org/documentation/why_rsbac_does_not_use...

LSM (or SELinux when it was believed that LSM might be removed) are the suggested API for security modules ...

jake

Dazuko and the LSM API

hummassa — 2006-10-26T11:42:36+00:00

> Dazuko is one of a handful of security solutions that run on Linux, but
> are not maintained in the kernel tree and, in fact, have a relatively
> hostile attitude towards the suggested ways of moving their code into >
> the tree.
Would anyone care to clarify (with pointers, if possible) the above?
Especially IRT the "hostile attitude towards the suggested ways of moving
their code into the tree", and which are those suggested ways?