Messages in this thread | | | From | Kyle Moffett <> | Subject | Re: [TOMOYO 14/15] Conditional permission support. | Date | Mon, 27 Aug 2007 08:11:15 -0400 |
| |
On Aug 25, 2007, at 22:13:48, Tetsuo Handa wrote: > Pavel Machek wrote: >> What is that? Language parser in kernel? > > Yes. This is a policy parser in kernel. > > TOMOYO Linux' policy is passed from/to the kernel as a plain text > (i.e. ASCII printable) file via /proc/tomoyo interface. > > For example, to add a permission to allow /usr/sbin/sshd to > execute /bin/bash if the authenticated user's uid = 500, the > administrator runs > > # /bin/cat > /proc/tomoyo/domain_policy << EOF > select <kernel> /usr/sbin/sshd > 1 /bin/bash if task.uid=500 > EOF
This is probably not acceptable; I doubt there's a chance in hell that TOMOYO will get merged as long as it has text-based-language parsing in the kernel. You also have $NEW_RANDOM_ABUSE_OF_PROCFS and $PATH_BASED_LSM_ISSUES. See the long flamewars on AppArmor for discussion on the latter.
Cheers, Kyle Moffett
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |