[lkml]   [2007]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook wrote:
    > On Mon, 28 May 2007 21:54:46 EDT, Kyle Moffett said:
    >> Average users are not supposed to be writing security policy. To be
    >> honest, even average-level system administrators should not be
    >> writing security policy.
    That explains so much! "SELinux: you're too dumb to use it, so just keep
    your hands in your pockets." :-)

    AppArmor was designed to allow your average sys admin to write a
    security policy. It makes different design choices than SELinux to
    achieve that goal. As a result, AppArmor is an utter failure when
    compared to SELinux's goals, and SELinux in turn is an utter failure
    when compared to AppArmor's goals.

    Which is why we have LSM: so we don't have to have this argument here,

    >> It's OK for such sysadmins to tweak
    >> existing policy to give access to additional web-docs or such, but
    >> only expert sysadmin/developers or security professionals should be
    >> writing security policy. It's just too damn easy to get completely
    >> wrong.
    > The single biggest challenge in computer security at the present time is how to
    > build *and deploy* servers that stay reasonably secure even when run by the
    > average wave-a-dead-chicken sysadmin, and desktop-class boxes that can survive
    > the best attempts of Joe Sixpack's "Ooh shiny" reflex, and Joe's kid's attempts
    > to evade the nannyware that Joe had somebody install.
    That is a tall order. You can mostly achieve it by not giving the user
    the root password, but I'm not sure you would like the result :-)

    Both SELinux and AppArmor can be configured so tightly that you are not
    going to get to install malware, by preventing the user from installing
    software. This isn't what users want, so they invariably bypass security
    and install shiny things if they own the box. SELinux and AppArmor can't
    help but fail if you put them in that kind of harm's way.


    Crispin Cowan, Ph.D.
    Director of Software Engineering
    Security: It's not linear

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-05-30 07:55    [W:0.023 / U:0.496 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site