Date: Wed, 31 May 2017 20:31:01 +0900 From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> To: jmorris@...ei.org Cc: gnomes@...rguk.ukuu.org.uk, keescook@...omium.org, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com, casey@...aufler-ca.com, hch@...radead.org, igor.stoppa@...wei.com, james.l.morris@...cle.com, paul@...l-moore.com, sds@...ho.nsa.gov Subject: Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head James Morris wrote: > On Wed, 31 May 2017, Tetsuo Handa wrote: > > > via lack of ability to use LKM-based LSM modules). My customers cannot afford > > enabling SELinux, but my customers cannot rebuild their kernels because > > rebuilding makes it even more difficult to get help from support centers. > > Therefore, my customers remain unable to use LSM modules which they want. > > This is really unfortunate for me. > > And they'll be able to get vendor support when they have their own custom > LSMs installed? As long as customers are using the vmlinux provided by that distributor, they can get distributor's support regarding problems which are not caused by use of their own custom LKM-based LSMs. For example, distributors do not unconditionally reject due to use of storage driver kernel module provided by hardware venders (or, their servers won't boot) and/or on-access scanner kernel module provided by antivirus venders. Customers won't be able to get distributor's support regarding problems caused by use of storage driver / on-access scanner kernel modules not provided by distributors. But rebuilding the vmlinux in order to use LSM modules not enabled by distributors makes customer's situation very worse.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.