[PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head

Alan Cox wrote:

quoted

I saw several companies who ship their embedded devices with
single-function LSM modules (e.g. restrict only mount operation and
ptrace operation). What is unfortunate is that their LSM modules had
never been proposed for upstream, and thus bugs remained unnoticed.

So which of them cannot be done with seccomp ? We have a small tight
interface for simple things like restricting a few calls.

They restricted based on hard-coded rules. seccomp is too much for their cases.

quoted

via lack of ability to use LKM-based LSM modules). My customers cannot afford
enabling SELinux, but my customers cannot rebuild their kernels because
rebuilding makes it even more difficult to get help from support centers.

And "I've loaded this third party module" doesn't ?

Situation is far much better than "I've recompiled this vmlinux". ;-)
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html