Re: The disappearing sys_call_table export.

[Alan Cox]

On Llu, 2003-05-12 at 23:12, [e-mail] wrote:
> >   "That can be done manually" does not get you the check mark in
> > the list of features.  Management wants idiot-resistant security.
> 
> In particular, the code that handles the zeroing out of resource objects
> before re-use needs to be "inside" the trusted-base perimeter.  This has
> been well-understood for years - even my August 83 copy of the Orange Book
> says (for class C2):

1. Base Linux is not C2 certified
2. C2 is obsolete
3. NSA SELinux can do the needed stuff from scanning the code
4. Even then data erasure is not guaranteed because of the drive logic

So you are back to crypting swap in the first place