[lkml]   [2007]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
On Sat, 9 Jun 2007, Kyle Moffett wrote:

> On Jun 09, 2007, at 01:18:40, wrote:
>> SELinux is like a default allow IPS system, you have to describe EVERYTHING
>> to the system so that it knows what to allow and what to stop.
> WRONG. You clearly don't understand SELinux at all. Try booting in
> enforcing mode with an empty policy file (well, not quite empty, there are a
> few mandatory labels you have to create before it's a valid policy file).
> /sbin/init will load the initial policy, attempt to re-exec() itself... and
> promptly grind to a halt. End-of-story.

two paragraphs below what you quoted I acknowledged exactly what you
state. however since you must tag everything before you turn on any
security it seems to me that you have to define everything, which is a
similar amount of work as you would have to do for a default allow policy.

> Typical "targetted" policies leave all user logins as unrestricted, adding
> security for daemons but not getting in the way of users who would otherwise
> turn SELinux off. On the other hand, a targeted policy has a "trusted" type
> for user logins which is explicitly allowed access to everything.

Ok, it sounds as if I did misunderstand SELinux. I thought that by
labeling the individual files you couldn't do the 'only restrict apache'
type of thing.

> That said, if you actually want your system to *work* with any default-deny
> policy then you have to describe EVERYTHING anyways. How exactly do you
> expect AppArmor to "work" if you don't allow users to run "/bin/passwd", for
> example.

for AA you don't try to define permissions for every executable, and ones
that you don't define policy are unrestricted.

so as I understand this with SELinux you will have lots of labels around
your system (more as you lock down the system more) you need to define
policy so that your unrestricted users must have access to every label,
and every time you create a new label you need to go back to all your
policies to see if the new label needs to be allowed from that policy

is this correct?

David Lang

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2007-06-09 18:51    [W:0.260 / U:0.108 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site