Messages in this thread | | | Date | Wed, 19 Apr 2006 18:32:30 -0700 | From | Crispin Cowan <> | Subject | Re: [RFC][PATCH 0/11] security: AppArmor - Overview |
| |
Andi Kleen wrote: > On Thursday 20 April 2006 01:00, grundig wrote: > >> From my user POV it seems >> really weird that a feature forbids you from using another unrelated feature >> > e.g. using a firewall usually prevents some applications > from working. Or using hugepages is not compatible with a lot of other VM > features. Or some locking doesn't work over NFS. > Exactly. The basic function of an access control system is to block access, selectively. So it is quite natural for AppArmor, and SELinux, to block access to various kernel features at various times. Because AppArmor is fundamentally name-based access control, changes to the name space affect AppArmor, and thus access to changing the name space must be managed.
Our controls on changing the name space have rather poor granularity at the moment. We hope to improve that over time, and especially if LSM evolves to permit it. This is ok, because as Andi pointed out, there are currently few applications using name spaces, so we have time to improve the granularity.
Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |