Messages in this thread | | | Subject | Re: ACLs | From | Alan Cox <> | Date | Sun, 06 Aug 2006 02:23:38 +0100 |
| |
Ar Sad, 2006-08-05 am 21:03 +0200, ysgrifennodd RazorBlu: > That is part of my point. The ACL system included with Linux (whether it > be the POSIX ACLs or SELinux) are too complex for use by most system > administrators, and so are overlooked. Actually, that last statement is > untrue - POSIX ACLs seem to be lacking slightly in functionality, and > SELinux is overly complicated (see a previous reply in which someone > else said that). AppArmor seems to be heading along the right tracks,
It depends what you are trying to achieve.
> policy for a service. However, it probably won't be included in the > kernel, especially in the near future (SELinux, which is associated with > the NSA, is already there - why add another one, even if it is more > advanced?)
I think the consensus if anything was more to adding AppArmor once it is cleaned up than not. Its far more primitive than SELinux and has a very basic security model but it can be easier to configure some basic setups with it which makes it useful to some people
The LSM means the kernel doesn't have to have an opinion any more than it has to define your choice of file system.
> Because SELinux is too complicated to be used effectively by most system > administrators - that's why.
Thats why vendors ship policies. Firewalling has the same problem.
Alan
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |