[lkml]   [2006]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC][PATCH 0/11] security: AppArmor - Overview
On Monday 24 April 2006 15:11, Joshua Brindle wrote:

> Sure but if, instead, it's able to open /var/chroot/etc/shadow which is
> a hardlink to /etc/shadow you've bought nothing. You may filter out
> worms and script kiddies this way but in the end you are using obscurity
> (of filesystem layout, what the policy allows, how the apps are
> configured, etc) for security, which again, leads to a false sense of
> security.

AppArmor disallows both chroot and name space changes for the constrained
application so the scenario you're describing cannot happen. What happens
with unconstrained applications it doesn't care about by design.

This has been covered several times in this thread already - please pay
more attention.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2006-04-24 15:28    [W:0.364 / U:40.484 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site