Re: [gentoo-hardened] SElinux

[Stephen Bennett]

On Tue, 2005-04-05 at 09:17 +0000, Genco YILMAZ wrote:
> Hi,
> I have been trying to learn pros and cons of SELinux and Grsecurity for
> a period of time. Gentoo docs leave decision to us
> so that we can use two and decide which one to use. I have read a Case
> Study comparing Kernel Enhancements of these two methods from Virginia
> University.
>           In one part, documents says that SELinux reimplemented as a
> security model using LSM and Grsecurity doesnt use LSM.
> After that, study tells the thougths of Spengler, which say LSM is
> compiled and enabled in kernel, its symbols are exported. Thus, every
> rootkit and backdoor writer will have every hook he ever wanted in the
> kernel. This will allow for a new generation of sophisticated backdoors and
> rootkits that will be nearly impossible to detect.
>           I have also read this statement in grsecurity.net.
> A question comes into my mind after reading these docs as a user not
> having much knowledge of internals of the kernel,
> this isn't a threat for the future?, if yes, what is going to be the
> future of SELinux?
>       I am sorry, If I am out of the subject a little bit, but I really
> would like to learn thoughts of others about this subject...

The only problem with that line of reasoning is that anyone with the
necessary access to load a kernel module using LSM symbols is perfectly
capable of using one of the existing non-lsm-aware rootkits to acheive
the same thing. The only thing it does is make writing the things
slightly easier, but those inclined towards writing rootkits have
already proved that they're more than capable of doing it the
old-fashioned way on a non-lsm kernel. Plus they're more likely not to
use LSM hooks on the basis that the percentage of systems out there with
it enabled is still fairly small.

--
gentoo-hardened@g.o mailing list