lkml.org 
[lkml]   [2010]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Upstream first policy


On Tue, 9 Mar 2010, Al Viro wrote:
>
> BTW, if you actually look at apparmor (I'd suggest tomoyo, but I'm not _that_
> sadistic), you'll see how seriously do they take pathname-based *anything*.
> LSM hooks for namespace operations (you know, mount, umount) are lousy, but
> they exist. Not used by apparmor.

That's a good point, btw, and shows one conceptual difference between
content-based and pathname-based rules.

For example, if you want to log any changes to "/etc/passwd" (which is
something pretty reasonable to do at least conceptually), what about doing
a bind mount on top of that file?

That bind mount doesn't actually change the underlying file in any way. It
doesn't even really _access_ it. From a content standpoint of the
filesystem that contains the file, it's a total no-op.

But from an attack standpoint, you don't actually care, because nobody
cares about the inode that used to be the contents of "/etc/passwd": all
anybody _really_ cares about is "could somebody change what happens to the
_name_ '/etc/passwd'".

But yeah, it's easy to overlook namespace changes when the obvious
operations are read/write/unlink/rename. And I'm not at all surprised that
people do.

Linus


\
 
 \ /
  Last update: 2010-03-09 02:53    [W:0.074 / U:1.248 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site