Language Selection

English French German Italian Portuguese Spanish

Kernel space: Linux security non-modules and AppArmor

Filed under
Linux

Long-time LWN readers will know that the Linux security module (LSM) API is controversial at best. To many, it has failed in its purpose, which is enabling the development of competing approaches to hardened Linux system; the only significant in-tree security module remains SELinux. Meanwhile, the LSM interface is easily abused; since it allows the insertion of hooks into almost any system operation of interest, it can be used by other modules to provide non-security functionality. The LSM symbols are mostly exported GPL-only, but it is still possible for binary-only modules to abuse the LSM operations - and, apparently, some have done so.

SELinux hacker James Morris has been pondering this issue recently; he has also noticed that the in-tree security modules (SELinux and the small module implementing capabilities) cannot be unloaded. So, he asked, why implement a modular interface at all?

There have been a few complaints, but, from the author's point of view, it does not seem like anybody has come up with a compelling reason why it must be possible to unload security modules.

One such module is AppArmor - the GPL-licensed security mechanism distributed by Novell.

More Here.




More in Tux Machines

Review: Simplicity Linux 15.4 alpha

Overall I give it 2 Thumbs Up on speed and layout of OS. If you have a computer with low resources, then this is an OS for you to try. Read more

Eurostat continues to share and use open source

Eurostat, the statistical office of the European Communities, continues to release as open source its ICT solutions. To date, Eurostat has shared 102 solutions on the European Commission’s Joinup platform. The statistical office has been using and sharing open source for more than a decade. Already in 2004 Eurostat’s ICT policy stipulated to consider open source software for all new projects. Read more

Excellent: Android Ecosystem is Low-Margin, Fragmenting

What the figures really show is that Apple is price-gouging its customers, extracting unreasonable levels of profit by virtue of its monopoly. In the world of Android, by contrast, the fierce competition that exists between fungible manufacturers has driven down profit margins to razor-thin levels. Open source, and the level playing field that it creates, is a great way for maximising the benefits to customers, rather than companies. Read more

Open source empowers Sintra health centre

Open source tools used by ACES Sintra include content management system Wordpress, combined with the usual LAMP stack: the MySQL database management system, the Apache web server, Linux for the server host and the PHP web development scripting language. The combination is used for the public website, but also for several internal Intranet project and team sites. The organisation implements Wiki websites, mainly for the IT department but also to maintain a list of frequently asked questions and their answers. Read more