[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5b6397fc76e820118f20edebe9dc454e1a8ac620.camel@kjb.biglobe.ne.jp>
Date: Sat, 07 Nov 2026 00:53:30 +0900
From: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>
To: Paul Moore <paul@...l-moore.com>
Cc: kernel-hardening@...ts.openwall.com, keescook@...nel.org,
mic@...ikod.net, linux-security-module@...r.kernel.org
Subject: Re: [RFC idea] Kernel API Firewall (kaf): subsystem-level attack
surface reduction for the post-AI-CVE era
>
> It should be possible to do most, if not all, of these things with an
> LSM. Wearing my SELinux hat, I can say that SELinux currently
> provides access controls for most of these things today. I would
> expect similar capabilities with the BPF LSM, although I can't speak
> to the coverage of any specific BPF LSM tools. I believe AppArmor
> and
> Smack cover some of these things, but I can't say for certain.
>
Thank you very much. I have a poor understanding of existing features
like SELinux and AppArmor, and I don't know how to handle them well.
I believe that if there is a mechanism to discard problematic APIs when
called, we can temporarily address them until the fix is complete. I
just thought it might help reduce the workload.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
