On Mon, Sep 9, 2013 at 4:30 PM, James Bottomley <james.bottom...@hansenpartnership.com> wrote: > On Mon, 2013-09-09 at 16:20 -0700, Kees Cook wrote: >> On Mon, Sep 9, 2013 at 4:19 PM, David Lang <da...@lang.hm> wrote: >> > And if SELinux can do the job, what is the reason for creating this new >> > option? >> >> Not everyone uses SELinux. :) Also, it's rarely controlled the things >> we want to control here. > > It comes on by default (or its equivalent: AppArmour) in almost every > shipping distro.
Right, if "LSM" was meant here, yeah, I do use an LSM. But they, as a class of security policy in the kernel, handle isolation of entirely different things. The goal of "no way to mess with ring-0" isn't really related to the goals of the LSM in general, or specific MACs in particular. -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
