[gentoo-amd64] Re: catch 22 with realtime-lsm and commoncap (capability dependency) modules

[Duncan]

Kyle Lutze posted <444C0482.4090408@×××××××××××.com>, excerpted below,  on
Sun, 23 Apr 2006 15:49:38 -0700:

> re-emerging jack-audio-connection-kit with "-caps" did the trick, go
> figure. everything else was perfect
>
> on a side note, if capabilities was replaced by realtime and lsm, why is
> capabilities still in the 2.6 kernel?

I'm not familiar with the 2.4 capacities module and how it worked, so
can't answer that aspect of the question.  However, in kernel 2.6, there's
the Linux Security Module (LSM) framework.  It's designed to expose the
necessary kernel hooks for any of several different security module
approaches in a pluggable way, so any of several modules can be enabled to
take advantage of it.

In 2.6, the capacities module is implemented using LSM, designed to plug
into LSM and to provide the "traditional" Linux security implementation. 
Apparently, realtime-lsm is a second available plugin.  IIRC there's at
least a third as well, the BSD audit security framework, and I believe I
read that SELinux has a module too, tho for all I know it uses the BSD
audit module, perhaps with a few modifications, not its own separate
module.

It shouldn't therefore be entirely surprising that realtime-lsm and
capacities conflict, as they are probably fighting for control of the same
thing.  Is it possible to use two different LSMs together in any case?  I
don't know, but it's evident that there's a conflict here.  It appears you
can use one or the other but not both at the same time.  You plug in one,
and it takes at least part of the interface the other one would plug
into, so you can't plug in the other.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman in
http://www.linuxdevcenter.com/pub/a/linux/2004/12/22/rms_interview.html


-- 
gentoo-amd64@g.o mailing list