[lkml]   [2007]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: AppArmor FAQ
    Stephen Smalley  wrote:
    >Integrity protection requires information flow control; you can't
    >protect a high integrity process from being corrupted by a low integrity
    >process if you don't control the flow of information. Plenty of attacks
    >take the form of a untrusted process injecting data that will ultimately
    >be used by a more trusted process with a surprising side effect.

    I don't agree with this blanket statement. In a number of cases
    of practical interest, useful integrity protection can be achieved
    without full information flow control. Suppose you have a malicious
    ("low integrity") process A, and a target ("high integrity") process B.
    We want to prevent A from attacking B. One way to do that is to ensure
    that A has no overt channel it can use to attack process B, by severely
    restricting A's ability to cause side effects on the rest of the world.
    This is often sufficient to contain the damage that A can do.

    Of course, if the intended functionality of the system requires A to
    communicate data to B, and if you don't trust B's ability to handle
    that data carefully enough, and if A is malicious, then you've got a
    serious problem.

    But in a number of cases (enough cases to be useful), you can provide
    a useful level of security without needing information flow control and
    without needing global, persistent labels.
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-04-19 23:03    [W:0.021 / U:2.452 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site