[lkml]   [2007]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: AppArmor FAQ
    On Tue, April 17, 2007 23:55, Karl MacMillan wrote:
    > On Mon, 2007-04-16 at 20:20 -0400, James Morris wrote:
    >> On Mon, 16 Apr 2007, John Johansen wrote:
    >> > Label-based security (exemplified by SELinux, and its predecessors in
    >> > MLS systems) attaches security policy to the data. As the data flows
    >> > through the system, the label sticks to the data, and so security
    >> > policy with respect to this data stays intact. This is a good approach
    >> > for ensuring secrecy, the kind of problem that intelligence agencies
    >> have.
    >> Labels are also a good approach for ensuring integrity, which is one of
    >> the most fundamental aspects of the security model implemented by
    >> SELinux.
    >> Some may infer otherwise from your document.
    > Not only that, the implication that secrecy is only useful to
    > intelligence agencies is pretty funny. Personally, I think that
    > protecting the confidentiality of my data is important (and my bank and
    > health care providers protecting the data they have about me). Type
    > Enforcement was specifically designed to be able to address integrity
    > _and_ confidentiality in a way acceptable to commercial organizations.
    > Karl

    Shouldn't that be _OR_, as I have always understood confidentialy
    models like BLP are by their very nature incompatible with integrity
    models like Biba. Given this incompatibity, I think the idea that
    BLP style use of lables (ss/* property and the likes) is only usefull
    to intelligence agencies may well be correct, while usage for integrity
    models like Biba and CW would be much broader than that.

    A path based 'least priviledge' (POLP) solution would I think on its own
    address neither integity nor confidentiality, and next to this would
    proof to be yet an other 'fat profile' administration hell.

    Having said that, I feel a path based solution could have great potential
    if it could be used in conjunction with the object capability model, that
    I would consider a simple and practical alternative integrity model that
    does not require lables in an MLS maner, and that extends on the POLP
    concept in a way that would be largely more practical.
    That is, using 'thin' path based profiles would become very practical if
    all further authority can be communicated using handles in the same way
    that an open file handle can be communicated.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-04-18 09:23    [W:0.034 / U:1.136 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site