Messages in this thread | | | Subject | Re: [RFC][PATCH 0/11] security: AppArmor - Overview | From | Andi Kleen <> | Date | 20 Apr 2006 00:32:43 +0200 |
| |
Arjan van de Ven <arjan@infradead.org> writes: > > you must have a good defense against that argument, so I'm curious to > hear what it is
[I'm not from the apparmor people but my understanding is]
Usually they claimed name spaces as the reason it couldn't work.
In practice AFAIK basically nobody uses name spaces for anything. AppArmor just forbids mounts/CLONE_NEWNS for the confined applications and there is no way a new name space can be created so the problem doesn't exist.
I suppose if name space based user space takes over the world there is a problem but I have yet to see any signs of plan9 like userland taking over the world (e.g. they're certainly not used for anything in the distributions I'm familiar with).
Some people claim it will be used in the future in a particular application that most people I know don't want to have anything to do with, but right now that application uses an own file system that is also unlikely to work with selinux or anything so it won't change anything for that.
I'm not aware of any other proposed application.
Also name spaces can be still used of course, just not with apparmor limited applications.
So it's an interesting theoretical discussion, but in practice it's a non issue.
Anyways, I guess the bigger issue is with hard links anyways (Chris gave a long list of other ways to get aliases in path names earlier). Discussing those might be much more fruitful.
That said I'm personally not too fond of path named filtering either (it always seemed ugly to me), but I haven't seen anybody proposing anything better so far that wasn't insanely complex and basically impossible to administer.
-Andi - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |