LSM chaining ("stacking") is a good idea
LSM chaining ("stacking") is a good idea
Posted Jun 24, 2010 15:14 UTC (Thu) by dwheeler (guest, #1216)Parent article: LSM stacking (again)
I think it is a *good* idea to implement what this article calls "LSM chaining" (I called it LSM stacking when I wrote such an implementation for the Linux kernel). The worries about interference are overblown. I would expect that typical use would involve one "big" module (like SELinux) that covers the general case, plus zero or more "small" modules that forbid or restrict certain specific actions. If it's cumulatively restrictive, many of the problems of figuring out what's okay to combine are quite easy.
Sure, a bad configuration/implementation can mess up security... but NOT having this capability makes it impossible to easily implement security configurations that you DO want. And PAM shows that you CAN reasonably combine modules to produce useful effects.