lkml.org 
[lkml]   [2010]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Upstream first policy


    On Mon, 8 Mar 2010, Alan Cox wrote:
    >
    > Its path based in the sense that public_html has a path based meaning by
    > convention understood by httpd. Copy a jpeg into your public_html and it
    > will be labelled up for http access under the Fedora shipped rule sets.

    Umm. That was my point all along: you can basically "emulate" pathname
    based decisions by labeling things. But it's not always the most direct
    approach, and some people clearly do find AppArmor (or Tomoyo, which I
    think is also largely based on pathnames) to be more "intuitive".

    So I don't understand it when people then complain about a mechanism that
    base their decisions fundamentally on the pathname. It's not like AppArmor
    got rid of the traditional unix inode-based protections and replaced them
    (like your silly DEC10 example).

    But whatever. The fact is, Ubuntu uses it. We'll merge it.

    Linus


    \
     
     \ /
      Last update: 2010-03-08 20:35    [W:4.149 / U:0.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site