Language Selection

English French German Italian Portuguese Spanish

Kernel space: Linux security non-modules and AppArmor

Filed under

Long-time LWN readers will know that the Linux security module (LSM) API is controversial at best. To many, it has failed in its purpose, which is enabling the development of competing approaches to hardened Linux system; the only significant in-tree security module remains SELinux. Meanwhile, the LSM interface is easily abused; since it allows the insertion of hooks into almost any system operation of interest, it can be used by other modules to provide non-security functionality. The LSM symbols are mostly exported GPL-only, but it is still possible for binary-only modules to abuse the LSM operations - and, apparently, some have done so.

SELinux hacker James Morris has been pondering this issue recently; he has also noticed that the in-tree security modules (SELinux and the small module implementing capabilities) cannot be unloaded. So, he asked, why implement a modular interface at all?

There have been a few complaints, but, from the author's point of view, it does not seem like anybody has come up with a compelling reason why it must be possible to unload security modules.

One such module is AppArmor - the GPL-licensed security mechanism distributed by Novell.

More Here.

More in Tux Machines

Budgie 10.2.8 Desktop Brings New Places Indicator Applet, Countless Improvements

After informing us about the release of the Solus 1.2.1 "Shannon" operating system, the Solus Project team proudly announced the availability of the Budgie 10.2.8 desktop environment for various GNU/Linux distributions. Read more

Ubuntu Turns 12, Happy Birthday!

Today, October 20, 2016, is Ubuntu's birthday! Its 12th anniversary since the release of the first Ubuntu version, namely Ubuntu 4.10 (Warty Warthog), which was originally announced by Canonical and Ubuntu founder Mark Shuttleworth on the 20th of October 2004. Read more

Android Leftovers