Messages in this thread | | | Date | Wed, 23 May 2007 21:28:52 -0400 (EDT) | From | James Morris <> | Subject | Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook |
| |
On Wed, 23 May 2007, Andreas Gruenbacher wrote:
> This is backwards from what AppArmor does. The policy defines which paths may > be accessed; all paths not explicitly listed are denied. If files are mounted > at multiple locations, then the policy may allow access to some locations but > not to others. That's not a hole.
I don't know what else you'd call it.
Would you mind providing some concrete examples of how such a model would be useful?
- James -- James Morris <jmorris@namei.org> - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |