[lkml]   [2007]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    On Fri, 15 Jun 2007, Greg KH wrote:

    >>> Usually you don't do that by doing a 'mv' otherwise you are almost
    >>> guaranteed stale and mixed up content for some period of time, not to
    >>> mention the issues surrounding paths that might be messed up.
    >> on the contrary, useing 'mv' is by far the cleanest way to do this.
    >> mv htdocs htdocs.old;mv htdocs
    >> this makes two atomic changes to the filesystem, but can generate thousands
    >> to millions of permission changes as a result.
    > I agree, and yet, somehow, SELinux today handles this just fine, right?
    > :)

    no it doesn't, SELinux as-is should take no action when the above command
    is run, but SELinux implementing path-based permissions will have to
    relabel every file or directory in both trees.

    > Let's worry about speed issues later on when a working implementation is
    > produced, I'm still looking for the logical reason a system like this
    > can not work properly based on the expected AA interface to users.

    if you are willing to live with the race conditions from the slow
    (re)labeling and write the software to scan the entire system to figure
    out the right policies (and then use inotify to watch the entire system
    for changes and (re)label the appropriate files) and accept that you can't
    get any granular security for filesystems that don't nativly support it
    you could make SELinux behave like AA.

    but why should they be required to? are you saying that the LSM hooks are
    not a valid API and should be removed with all future security modules
    being based on SELinux?

    David Lang
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-06-16 10:13    [W:0.021 / U:36.812 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site