Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760379Ab0FRKzO (ORCPT ); Fri, 18 Jun 2010 06:55:14 -0400 Received: from DMZ-MAILSEC-SCANNER-3.MIT.EDU ([18.9.25.14]:64849 "EHLO dmz-mailsec-scanner-3.mit.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751178Ab0FRKzM convert rfc822-to-8bit (ORCPT ); Fri, 18 Jun 2010 06:55:12 -0400 X-AuditID: 1209190e-b7b82ae000005260-8a-4c1b508e85aa Subject: Re: [PATCH] ptrace: allow restriction of ptrace scope Mime-Version: 1.0 (Apple Message framework v1078) Content-Type: text/plain; charset=us-ascii From: Theodore Tso In-Reply-To: <4C1AE3A8.2020104@schaufler-ca.com> Date: Fri, 18 Jun 2010 06:54:57 -0400 Cc: Alan Cox , Kees Cook , Randy Dunlap , James Morris , linux-kernel@vger.kernel.org, Andrew Morton , Jiri Kosina , Dave Young , Martin Schwidefsky , Roland McGrath , Oleg Nesterov , "H. Peter Anvin" , David Howells , Ingo Molnar , Peter Zijlstra , "Eric W. Biederman" , linux-doc@vger.kernel.org, Stephen Smalley , Daniel J Walsh , linux-security-module@vger.kernel.org Content-Transfer-Encoding: 8BIT Message-Id: References: <20100616221833.GM24749@outflux.net> <20100617000120.13071be8@lxorguk.ukuu.org.uk> <20100616232230.GP24749@outflux.net> <20100617170453.GV24749@outflux.net> <20100617215349.2fac02f5@lxorguk.ukuu.org.uk> <20100617140630.c6ced27a.rdunlap@xenotime.net> <20100617221815.68ce30c5@lxorguk.ukuu.org.uk> <20100617215105.GB24749@outflux.net> <20100617233054.330256cf@lxorguk.ukuu.org.uk> <4C1AE3A8.2020104@schaufler-ca.com> To: Casey Schaufler X-Mailer: Apple Mail (2.1078) X-Brightmail-Tracker: AAAAAA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 999 Lines: 22 i think we really need to have stacked LSM's, because there is a large set of people who will never use SELinux. Every few years, I take another look at SELinux, my head explodes with the (IMHO unneeded complexity), and I go away again... Yet I would really like a number of features such as this ptrace scope idea --- which I think is a useful feature, and it may be that stacking is the only way we can resolve this debate. The SELinux people will never believe that their system is too complicated, and I don't like using things that are impossible for me to understand or configure, and that doesn't seem likely to change anytime in the near future. I mean, even IPSEC RFC's are easier for me to understand, and that's saying a lot... -- Ted -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/