lkml.org 
[lkml]   [2007]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    From
    Date
    On Fri, 2007-06-22 at 21:34 +1000, Neil Brown wrote:
    > On Friday June 22, sds@tycho.nsa.gov wrote:
    > > >
    > > > Yes. Your use case is different than mine.
    > >
    > > My use case is being able to protect data reliably. Yours?
    >
    > Saying "protect data" is nearly meaningless without a threat model.
    > I bet you don't try to protect data from a direct nuclear hit, or a
    > court order.
    >
    >
    > AA has a fairly clear threat model. It involves a flaw in a
    > program being used by an external agent to cause it to use
    > privileges it would not normally exercise to subvert privacy or
    > integrity.
    > I think this model matches a lot of real threats that real sysadmins
    > have real concerns about. I believe that the design of AA addresses
    > this model quite well.
    >
    >
    > What is your threat model? Maybe it is just different.

    The threat "model" you describe above is a subset of what SELinux
    addresses. And our argument is that AA does not meet that model well,
    because it relies upon ambiguous and unstable identifiers for subjects
    and objects (a violation of the fundamental requirements for access
    control) and because it provides very incomplete mediation.

    >From http://www.nsa.gov/selinux/info/faq.cfm:
    The Security-enhanced Linux's new features are designed to enforce the
    separation of information based on confidentiality and integrity
    requirements. They are designed for preventing processes from reading
    data and programs, tampering with data and programs, bypassing
    application security mechanisms, executing untrustworthy programs, or
    interfering with other processes in violation of the system security
    policy. They also help to confine the potential damage that can be
    caused by malicious or flawed programs. They should also be useful for
    enabling a single system to be used by users with differing security
    authorizations to access multiple kinds of information with differing
    security requirements without compromising those security requirements.

    --
    Stephen Smalley
    National Security Agency

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-22 13:53    [W:5.353 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site