Subject: Re: Preventative security features?
To: Tim Kelly <hockey@dialectronics.com>
From: Brett Lymn <blymn@baesystems.com.au>
List: tech-security
Date: 11/15/2004 13:20:31
On Sun, Nov 14, 2004 at 08:25:35PM -0500, Tim Kelly wrote:
> 
> I thought the scope was new features. Suggesting something already in
> the tree and available doesn't count :-)
> 

Awwwww it doesn't count that it's my code? ;)

> Seriously, though, what's the drawback?

Probably the worst is that it does have a negative impact on file opens
and that it is a real pain in the butt if you want to change things.  The
scheme is really meant for specific function machines like routers and
firewalls where you want to make sure things are not changed.

> How is compatibility with
> packages, 

100% compatable.

>and is it available across all ports?
> 

Not yet.  That is my bad.  I need to do the work to put the pseudo-device
into all the architectures which is scary for me because I can only test
3 architectures (i386, amd64 and sparc).  The actual kernel stuff is
machine independent, it's just the fingerprint loading pseudo-device that
is missing.

-- 
Brett Lymn