[lkml]   [2006]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks
    On Tue, 2006-04-18 at 09:50 -0700, Gerrit Huizenga wrote:
    > On Tue, 18 Apr 2006 12:58:19 BST, Christoph Hellwig wrote:
    > > On Mon, Apr 17, 2006 at 06:44:51PM -0700, Gerrit Huizenga wrote:
    > > >
    > > > On Mon, 17 Apr 2006 23:55:25 BST, Christoph Hellwig wrote:
    > > > > On Mon, Apr 17, 2006 at 03:15:29PM -0700, Gerrit Huizenga wrote:
    > > > > > configure correctly that most of them disable it. In theory, LSM +
    > > > > > something like AppArmour provides a much simpler security model for
    > > > >
    > > > > apparmor falls into the findamentally broken category above, so it's
    > > > > totally uninteresting except as marketing candy for the big red company.
    > > >
    > > > Is there a pointer to why it is fundamentally broken? I haven't seen
    > > > such comments before but it may be that I've been hanging out on the
    > > > wrong lists or spending too much time inhaling air at 30,000 feet.
    > >
    > > It's doing access control on pathnames, which can't work in unix enviroments.
    > > It's following the default permit behaviour which causes pain in anything
    > > security-related (compare [1]).
    > >
    > >
    > > [1]
    > Interesting but I'm not impressed by the article. I think Stephen's
    > reference has a bit more meat to it. According to this article my
    > laptop should set so I have a white list of apps (which would be
    > really really long, ergo why make a list? I run much more than
    > 5 apps on a day to day basis). Even on a general purpose machine
    > that is shared by many users will have a large number of apps. When
    > your white list is a large percentage of the apps that are on the
    > machine, these two approaches start to converge.

    Which is one reason why SELinux has types (equivalence classes) - it
    makes it possible to group large numbers of applications or resources
    into the same security category. The targeted policy that ships with
    RHEL / Fedora shows how this works in practice.


    Karl MacMillan
    Tresys Technology

    > In the end it always
    > comes down to "how much security are you prepared to endure, given
    > that security almost always limits user capability".
    > Based on what this article says, it sounds like MACs and ACLs would be
    > required because without them they permit you to share data with people
    > that may not need that data, people should only have access to the
    > limited set of applications and data that they need, and the machine
    > should be tightened down to the point where the security approaches
    > absolute security.
    > While that might fit in with "perfect" security, most people aren't
    > interested in that level of perfection. "Default permit" was so popular
    > because it caught the obvious exploits without overly limiting people's
    > ability to use a machine. It is still pretty commonly used today.
    > Also, any security protection has a whole range of protections, from
    > firewalls, limiting which packages are installed, accounts/passwords,
    > validation of users, etc. Does everyone have to have "perfect" security
    > or are there places where a "less than perfect, easy to use, good enough"
    > security policy? I believe there is room for both based on the end
    > users' needs and desires. But that is just my opinion.
    > gerrit
    > -
    > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
    > the body of a message to
    > More majordomo info at

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-04-18 19:31    [W:0.037 / U:83.620 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site