Messages in this thread |  | | | Subject | Re: [Umbrella-devel] Re: Getting full path from dentry in LSM hooks | | From | Stephen Smalley <> | | Date | Fri, 03 Sep 2004 11:38:54 -0400 |
| |
On Fri, 2004-09-03 at 09:20, Kristian Sørensen wrote: > E.g. if a root owned process is restricted from accessing /var/www, and > the process is compromised by an attacker, no mater what he does, he > would not be able to access this directory.
Control access to objects, not names. Assign security attributes to the objects, and use those attributes in your access control checks, not a useless pathname. Otherwise, your "security" system will always be trivially bypassable.
-- Stephen Smalley <sds@epoch.ncsc.mil> National Security Agency
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |