[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Parallellizing the boot in Debian Squeeze - ready for wider testing

On Sunday 16 May 2010 03:35:09 Steve Langasek wrote:
> Given the difference in how kernels vs. init daemons are usually
> administered as part of a system, I think the runtime impact of supporting
> multiple LSMs in init is much more significant than supporting multiple
> LSMs in the kernel.  I don't think we want init to have shared lib deps
> for each of the available LSMs.

In the early days of LSM development there was the idea that LSM modules could 
be kernel modules, this idea was given up early on. The idea that modules 
could be "stacked" so that you could have multiple modules active at the same 
time (EG OpenWall /tmp protection as well as SE Linux) but that ended up not 
working well technically, so for ages it was only the Capability module that 
supported stacking.  A quick check of the dmesg on a testing system indicates 
that capability is not regarded as a separate module any more (or at least 
it's not in the dmesg).

The patch to the SysVInit for SE Linux is very small, it wouldn't be difficult 
to have support for a dozen such LSM modules with case statements.  Not that 
it would happen, the only LSM modules that are publicly available are SE 
Linux, Smack, AppArmor, and Tomoyo and I think that SE Linux is the only one 
that needs an init patch.

Reply to: