[lkml]   [2006]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [RFC][PATCH 0/11] security: AppArmor - Overview
    Arjan van de Ven <> writes:
    > you must have a good defense against that argument, so I'm curious to
    > hear what it is

    [I'm not from the apparmor people but my understanding is]

    Usually they claimed name spaces as the reason it couldn't work.

    In practice AFAIK basically nobody uses name spaces for
    anything. AppArmor just forbids mounts/CLONE_NEWNS for the confined
    applications and there is no way a new name space can be created so
    the problem doesn't exist.

    I suppose if name space based user space takes over the world
    there is a problem but I have yet to see any signs of plan9 like userland
    taking over the world (e.g. they're certainly not used for anything in
    the distributions I'm familiar with).

    Some people claim it will be used in the future in a particular application
    that most people I know don't want to have anything to do with,
    but right now that application uses an own file system that is also unlikely
    to work with selinux or anything so it won't change anything for that.

    I'm not aware of any other proposed application.

    Also name spaces can be still used of course, just not with
    apparmor limited applications.

    So it's an interesting theoretical discussion, but in practice
    it's a non issue.

    Anyways, I guess the bigger issue is with hard links anyways
    (Chris gave a long list of other ways to get aliases in path names
    earlier). Discussing those might be much more fruitful.

    That said I'm personally not too fond of path named filtering
    either (it always seemed ugly to me), but I haven't seen anybody
    proposing anything better so far that wasn't insanely complex
    and basically impossible to administer.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-04-20 00:36    [W:0.027 / U:3.868 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site