From: Kamil K. <ka...@ka...> - 2006-01-09 14:13:10
|
Hello. Like many others, I had problem with inability to use 2 lsm modules at the same time - trustees and capabilities together. There're many applications which rely on capabilities - in my case I needed Bind 9 running on system with trustees enabled. This was very urgent to me, so I had no choice but to patch the kernel. Please note that my solution is really a hack, not the proper implementation. I did the whole thing in 12h, including research on lsm inner workings, which I know little about, it wasn't properly tested and could crash your server, give everyone root access or make your microwave explode - you've been warned. Use this on production server only if you understand those pretty straight-forward changes and/or you're really pressed against the wall with this issue. It's running on 2 of my production servers for a week now without problems, but there're no guarantees. There are several approaches to the problem - I choosed attaching trustees as a secondary module to capabilities module. This is the least elegant solution, because it involves patching capabilities module, but is the simplest one to implement(less hooks to serve - less places to break something). For permanent solution it'd be better make trustees primary module and allow attaching capability as secondary - as selinux does. Maybe the project maintainer will choose this way for official implementation. Patches against 2.6.14.3 and trustees 3.0 are available here: http://kamil.eisp.pl/trustees Patch against trustees module is trivial and just allows it to register as secondary module. Most of the code has been ripped from other lsm modules - capability, selinux etc. After applying the patches, you must load capability module and then trustees module - the order is important. Hope this will help someone. Regards. -- Kamil Kaczkowski ka...@ka... |