[lkml]   [2006]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [RFC][PATCH 0/11] security: AppArmor - Overview
    Andi Kleen wrote:
    > On Thursday 20 April 2006 01:00, grundig wrote:
    >> From my user POV it seems
    >> really weird that a feature forbids you from using another unrelated feature
    > e.g. using a firewall usually prevents some applications
    > from working. Or using hugepages is not compatible with a lot of other VM
    > features. Or some locking doesn't work over NFS.
    Exactly. The basic function of an access control system is to block
    access, selectively. So it is quite natural for AppArmor, and SELinux,
    to block access to various kernel features at various times. Because
    AppArmor is fundamentally name-based access control, changes to the name
    space affect AppArmor, and thus access to changing the name space must
    be managed.

    Our controls on changing the name space have rather poor granularity at
    the moment. We hope to improve that over time, and especially if LSM
    evolves to permit it. This is ok, because as Andi pointed out, there are
    currently few applications using name spaces, so we have time to improve
    the granularity.

    Crispin Cowan, Ph.D.
    Director of Software Engineering, Novell

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-04-20 03:35    [W:0.026 / U:5.716 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site