lkml.org 
[lkml]   [2007]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    On Sat, 9 Jun 2007, Sean wrote:

    > On Fri, 8 Jun 2007 22:18:40 -0700 (PDT)
    > david@lang.hm wrote:
    >
    >> the way I would describe the difference betwen AA and SELinux is:
    >>
    >> SELinux is like a default allow IPS system, you have to describe
    >> EVERYTHING to the system so that it knows what to allow and what to stop.
    >>
    >> AA is like a default deny firewall, you describe what you want to happen,
    >> and it blocks everything else without you even having to realize that it's
    >> there.
    >>
    >> now I know that this isn't a perfect analyogy, that SELinux doesn't allow
    >> something to happen unless it's been told to let it, but in terms of
    >> complexity and the amount of work to configure things I think the analogy
    >> is close.
    >
    > It must be drop dead simple to modify SELinux to be default-deny. That
    > seems like it could be done in a small patch instead of requiring a huge
    > new infrastructure.

    did you read my explination of the analogy?

    > Let's assume that everyone agrees that AA is a good idea. Which parts of it
    > absolutely can't be implemented in terms of SELinux? SELinux isn't fixed in
    > stone, it can be altered if necessary to accommodate AA (as in the example
    > above of becoming default-deny).

    what SELinux cannot do is figure out what label to assign a new file.

    but the bigger problem in changing SELinux to behave like AA is that the
    SELinux people disagree with the concept of AA. they don't believe that
    it's secure, so why would they add useless bloat that would only
    complicate their code and make systems less secure? I don't happen to
    agree with their opinion of AA obviously, but they have the right to their
    opinion, and it is their code. why should they be asked to implement and
    support something they disagree with so fundamentally?

    remember that the security hooks in the kernel are not SELinux API's, they
    are the Loadable Security Model API. What the AA people are asking for is
    for the LSM API to be modified enough to let their code run (after that
    (and working in parallel) they will work on getting the rest of their code
    approved for the kernel, but the LSM hooks are the most critical)

    David Lang
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-09 09:17    [W:4.881 / U:0.504 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site