[PATCH v5 4/4] Add system-wide tunables: Filters

[DJ Delorie]

Florian Weimer <fweimer@redhat.com> writes:
>> Relying on environment variables *does* work for all kinds of
>> applications, though.
>
> It doesn't work for AT_SECURE binaries:

True, but those are normal binaries that system-wide tunables can
influence.  If we had a binary that was AT_SECURE *and* static *and*
required a tunable, we would not be able to support that.

>> For "true" security, you'd need something at the kernel level that can
>> be forcibly applied to all processes, regardless of how they run.
>> Tunables are not that thing.
>
> They can be for AT_SECURE binaries if we want that.

True, but not as significant a statement as you'd think.  Any admin who
can set the AT_SECURE bit is already on the 'inside' of the security
wall.  The question is, can tunables be used to implement security
policy as defined by admins, but applying to users, for *all* programs?
No, it can't, because users can just use a different loader.

Thus, I think it's important to keep in mind that tunables might be able
to assist in securing a system, but should not be relied on for
enforcing security.