On Mon, Sep 9, 2013 at 4:30 PM, James Bottomley <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx> wrote: > On Mon, 2013-09-09 at 16:20 -0700, Kees Cook wrote: >> On Mon, Sep 9, 2013 at 4:19 PM, David Lang <david@xxxxxxx> wrote: >> > And if SELinux can do the job, what is the reason for creating this new >> > option? >> >> Not everyone uses SELinux. :) Also, it's rarely controlled the things >> we want to control here. > > It comes on by default (or its equivalent: AppArmour) in almost every > shipping distro. Right, if "LSM" was meant here, yeah, I do use an LSM. But they, as a class of security policy in the kernel, handle isolation of entirely different things. The goal of "no way to mess with ring-0" isn't really related to the goals of the LSM in general, or specific MACs in particular. -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
