This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] [Xense-devel][RFC][PATCH][0/4] Xen Security Modules: Int

On Fri, 1 Sep 2006, Chris Wright wrote:

- LSM has a problem of not supporting stacking module, and that is really paint in the arse. How about XSM? Do you try to fix that problem?

I don't see anything in XSM that changes that limitation to LSM. In fact, it appears to not even support the very weak stacking via chaining mechanism (which is a good plan in this case). And it's questionable at best. Arbitrary security policies simply do not compose.

I'm not entirely convinced that the theoretically hard problem of arbitrary policy composition is that much of a problem in practice. A number of systems (RSBAC on Linux, kauth(9) on Mac OS X, the MAC Framework on FreeBSD and Mac OS X, and the fixed compositions of MAC policies in many trusted systems) have illustrated that you can do a lot of useful things using a fixed composition that is effectively a logical and of granted rights. That isn't the same as stacking, of course, since the composition happens in the containing framework, rather than in the policies. Obviously, there are limitations to this approach, but for many things, it works quite well in quite a few deployed real-world systems with moderately diverse policies.

Robert N M Watson
Computer Laboratory
University of Cambridge

Xense-devel mailing list