Language Selection

English French German Italian Portuguese Spanish

Kernel space: Linux security non-modules and AppArmor

Filed under
Linux

Long-time LWN readers will know that the Linux security module (LSM) API is controversial at best. To many, it has failed in its purpose, which is enabling the development of competing approaches to hardened Linux system; the only significant in-tree security module remains SELinux. Meanwhile, the LSM interface is easily abused; since it allows the insertion of hooks into almost any system operation of interest, it can be used by other modules to provide non-security functionality. The LSM symbols are mostly exported GPL-only, but it is still possible for binary-only modules to abuse the LSM operations - and, apparently, some have done so.

SELinux hacker James Morris has been pondering this issue recently; he has also noticed that the in-tree security modules (SELinux and the small module implementing capabilities) cannot be unloaded. So, he asked, why implement a modular interface at all?

There have been a few complaints, but, from the author's point of view, it does not seem like anybody has come up with a compelling reason why it must be possible to unload security modules.

One such module is AppArmor - the GPL-licensed security mechanism distributed by Novell.

More Here.




More in Tux Machines

Android Leftovers

Lubuntu 15.04 Beta 2 Is Not Using Systemd, Nor LXQt - Screenshot Tour

Lubuntu 15.04 is the last in our screenshot tour articles related to the Final Beta a.k.a. Beta 2 of the Vivid Vervet development cycle. Lubuntu 15.04 Beta 2 offers one of the most lightweight desktop experiences and it is now powered by Ubuntu 15.04’s Linux 3.19.2 kernel. Read more Also: Xubuntu 15.04 Beta 2 Released, Offers a Neat Xfce 4.12 Experience - Screenshot Tour

What is keeping you from switching to Linux?

I'd like to make time for switching my main system but it is not there yet. What I plan to do is however use Linux on my laptop and get used to it this way. While it will take longer than a radical switch, it is the best I can do right now. Eventually though, I'd like to run all but one system on Linux and not Windows. Read more Also: Who’s Using, And Not Using, GNU/Linux Desktops

5 Surprising Reasons Behind The GNOME Resurgence

When the team behind GNOME came out with GNOME 3, which included the infamous GNOME Shell, the most popular desktop environment of the time saw a sharp decrease in users. And honestly, that trend is pretty easy to explain. When GNOME 3 initially came out, it was incomplete, buggy, and foreign. The concepts behind GNOME Shell were never before seen on a desktop system, and lots of users who were used to panels/taskbars and menus didn’t like the rather dramatic changes. Read more