lkml.org 
[lkml]   [2007]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    On Thu, 21 Jun 2007, Lars Marowsky-Bree wrote:

    > A veto is not a technical argument. All technical arguments (except for
    > "path name is ugly, yuk yuk!") have been addressed, have they not?

    AppArmor doesn't actually provide confinement, because it only operates on
    filesystem objects.

    What you define in AppArmor policy does _not_ reflect the actual
    confinement properties of the policy. Applications can simply use other
    mechanisms to access objects, and the policy is effectively meaningless.

    You might define this as a non-technical issue, but the fact that AppArmor
    simply does not and can not work is a fairly significant consideration, I
    would imagine.



    - James
    --
    James Morris
    <jmorris@namei.org>
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-21 21:45    [W:4.486 / U:0.440 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site