[lkml]   [2007]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: AppArmor FAQ
    On Tue, 2007-04-17 at 11:03 -0400, David Safford wrote:
    > On Mon, 2007-04-16 at 20:20 -0400, James Morris wrote:
    > > On Mon, 16 Apr 2007, John Johansen wrote:
    > >
    > Actually, this is pretty much how z/OS/RACF works. Labels and pathnames
    > for all files are stored in one database. There are advantages and
    > disadvantages to this design, but is does work, and does have an EAL4+
    > certification on a Labeled Security Protection Profile.
    > > And you can still use pathnames under SELinux to locate an object to
    > > label, just as you do with DAC. You just don't put a security label on
    > > the path itself.
    > SELinux _has_ to use pathnames to fix some ugly cases where new files
    > are created with the wrong label. It uses restorecond to fix the labels
    > for files such as resolv.conf, mtab, utab, and wtab, when they are
    > created. The restorecond policy file is textual, and separate from the
    > SELinux labels, which is somewhat inelegant.

    No - the real fix is to change the applications or to run under a policy
    that confines all applications. Most of the problems with resolv.conf,
    mtab, etc. stem from admin processes (e.g., editors or shell scripts)
    all running under the same unconfined domain.

    In some cases applications need modification as only the application has
    enough information to determine the correct label. Usually this means
    preserving labels from input files or separating the output into
    distinct directories so type transitions or label inheritance will work.

    restorecond is just a hack not a requirement or a sign that something is
    wrong with the model. That is why it is a userspace application and not
    integrated into the kernel mechanism.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-04-17 18:07    [W:0.048 / U:9.456 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site