linux-kernel September 2007 archive
Main Archive Page > Month Archives  > linux-kernel archives
linux-kernel: Re: [PATCH] Version 3 (2.6.23-rc8) Smack: Simplifi

Re: [PATCH] Version 3 (2.6.23-rc8) Smack: Simplified Mandatory Access Control Kernel

From: Theodore Tso <tytso_at_nospam>
Date: Sun Sep 30 2007 - 20:22:25 GMT
To: Andi Kleen <ak@suse.de>


On Sun, Sep 30, 2007 at 10:05:57PM +0200, Andi Kleen wrote:
> > but a cluster of Linux machines in a rack is roughly the same size of
> > a huge Unix server tens year ago --- and it's not like Ethernet is any
> > more secure than the PCI bus.
>
> PCI busses normally don't have routers to networks outside the box connected
> to them.

The whole *point* is that the routers are interconnecting boxes inside the cluster, and none of them connect to the outside world. It's no different than a SCSI cable connecting to JBOD in a separate box, or a Fiber Channel router connected to a SAN network connecting to a storrage array. The SCSI or FC buses aren't encrypted either, and the in the Fiber channel case we have a router --- yet people aren't stressing out that we're not encrpying the traffic over the Storage Area Network? Why? Because it's understood the network stays inside the machine room. The same thing can true for Ethernet --- think iSCSI, for example.

> > So don't be so quick to dismiss something like
> > CIPSO out of hand, just because it doesn't use IPSEC.
>
> With your argumentation we could also just disable all security
> in these situations (as in null LSM to save some overhead); after all these
> systems are protected by armed guards. If someone gets past the guards
> they could connect their laptop to the network and fake all the "secured"
> packets. If you assume that won't happen why do you need computer security at all?

If you get past all of the guards, you can usually reboot in single user mode, and get root anyway. If you have physical access to the computer, you're generally doomed anyway, unless you are willing to pay the cost of encrypting everything on every single disk platter. (And yes, in the more paranoid environments, where it's too expensive to have 7x24 armed guards, maybe that makes sense.)

The point of something like CIPSO is because you want to label the packets so the otherside knows how they should be treated. We don't encrypt unix permission bits on most on-disk filesystems, either. Yet I haven't heard people saying that just because someone could break into a machine room, disconnect the JBOD from the computer, hook up the JBOD to their laptop, and futz with the Unix permission bits, rehook up the JBOD and reboot, that Unix permission bits are useless, and we should leave all files at mode 777 --- since clearly we're not secure against someone who can break into the machine room.....

I *hope* that sounds absurd, right?

  • Ted

-
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html