From: Andrew R. <ae...@ks...> - 2009-06-29 19:37:53
|
> Assuming Today 6/2009: > 1. Whats the Status of Trustees in Linux Today? Is it part of the > official Linux Kernel? or is it just "a patch" ? Nope, and unfortunately I doubt it ever will be. I haven't pursued it, but the selinux guys tend to view the LSM (Linux Security Module) API as the LSM (Linux SeLinux Module) API. Not to mention the fact that this patch tends to (ab)use the LSM API in ways it wasn't really intended to be used AND it effectively disables POSIX ACLs. > 2. whats the recent developing activities on linux trustees ? I try to keep it up to date, as you've maybe noticed the most recently supported kernel is 2.6.26.8. In general keeping it up to date on the minor versions (the 'y' in 2.6.x.y) is very easy whereas keeping it up to date on the major versions (the 'x' in 2.6.x.y) is a pain in the rear generally. I need to go through my e-mail because someone sent me a patch for 2.6.27 and it just needs to be tested. My apologies to the author of that e-mail. After that, pretty much 2.6.27.y will all be supported and perhaps 2.6.28 will go easily too... > 3. has trustees been contributed/send in to the linux kernel.org thingy > yet ? is there a chance to become official part/support of the kernel? I haven't pushed for it to be included because as I mentioned it won't be. It completely rewrites how unix permissions work and in general the security framework is only there to *limit* users, not add additional rights. In general, git makes it very simple for me to maintain a fork though. > 4. are there any prepared debian packages for Debian Lenny (repositories) ? Not that I know of... but if you can compile a debian kernel package, I can definitely help with the process of using the trustees-kernel.git repository for generating a patch that will probably apply to the debian kernel package. > 5. are ther any known new filesystem permission/security features in the > current or next-version kernel that might replace linux trustees or ACLs > in a "better way" ? Not that I know of... POSIX ACLs suck for this and unix permissions in general suck for centralizing your permission scheme. Trustees lets you put your entire permission scheme in a file in /etc and use it for your entire system. POSIX ACLs and unix permissions make you apply the permissions to every individual file. > 6. Did someone test linux trustees with current nfs and samba version? > or more specific: are there any known problems with that ? Nope, although I suppose I'm more in the position to test that nowadays than I used to be (having multiple machines helps! :)). If you have a particular scenario you'd like me to test, describe it for me. -- Andrew Ruder <an...@ae...> http://www.aeruder.net |