Critical Linux security API is still a kludge (Inquirer)

Posted Oct 23, 2006 16:30 UTC (Mon) by nix (subscriber, #2304)
In reply to: Critical Linux security API is still a kludge (Inquirer) by AJWM
Parent article: Critical Linux security API is still a kludge (Inquirer)

The LSM API intentionally does not stack. Stacking LSM modules that only restrict access is *probably* safe, but how can you be sure that the consequences of ANDing two unrelated modules' constraints together is still secure?

(This annoys me, too, but the reasoning for banning stacking is an absolute killer...)

Stacking IS allowed.

Posted Oct 23, 2006 18:44 UTC (Mon) by dwheeler (guest, #1216) [Link]

Stacking LSM modules IS allowed, just not in the way that you first consider.

When you install an LSM module, it explicitly takes over. If you want to have "stacked" modules, you need to FIRST install a "stacking" LSM module, and THEN install the other modules. The LSM interface was SPECIFICALLY designed to support this.

I wrote the first LSM stacking module. But it has now been taken over, and it's now the lsm-stacker project (I no longer have anything to do with it, other than being a fan of the concept). Unfortunately, this module is not currently in the main kernel tree... but that is the eventual intent.