User: Password:
Subscribe / Log in / New account

Seccomp: replacing security modules?

Seccomp: replacing security modules?

Posted May 19, 2011 18:43 UTC (Thu) by Yorick (subscriber, #19241)
In reply to: Seccomp: replacing security modules? by cmccabe
Parent article: Seccomp: replacing security modules?

Such a simple fixed-function syscall restriction API is probably good enough for many restricted tasks, and simpler (to use and to implement / audit) than some of the fancy solutions proposed described in the article. But going all the way to a pure capability-oriented interface along the lines of Capsicum would be even better. Unix already has most of the needed pieces - uniform descriptor-oriented syscalls, mainly - and it is just a matter of fixing things at the edges.

(Log in to post comments)

Seccomp: replacing security modules?

Posted May 20, 2011 22:42 UTC (Fri) by cmccabe (guest, #60281) [Link]

You can implement a pure capability model from userspace. The way to do it is to have some daemons that do the privileged operations on behalf of other processes. This is more or less the route Android went down.

Ingo's idea is probably a better way to implement LSM than the current implementation. The problem is, we don't really need LSM in the first place. All of the stuff that the NSA wanted to do with security levels and so forth could have been done in a much cleaner way from userspace.

The point of a sandboxing API is not to construct elaborate policies. It's a tool that makes it easier to implement secure systems in general. Then if people want elaborate policies, they can build that on top.

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds