[lkml]   [2007]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation,pathname matching

    --- Sean <> wrote:

    > The question is: why not just extend SELinux to include AA functionality
    > rather than doing a whole new subsystem.

    Because, as hard as it seems for some people to believe,
    not everyone wants Type Enforcement. SELinux is a fine
    implementation of type enforcement, but if you don't want
    what it does it would be silly to require that it be
    used in order to accomplish something else, like name based
    access control.

    If the same things made everyone feel "secure" there would be
    no optional security facilities (audit, cryptfs, /dev/random, ACLs).
    It appears that the AA folks are sufficiently unimpressed with
    SELinux they want to do something different. I understand that
    there is a contingent that believes security == SELinux.
    There are also people who believe security == cryptography or
    security == virus scanners. I'm happy that they have found what
    works for them.

    Also, "just extend" implies that it would be easy to do. I
    suggest you go read the SELinux MLS code, and go read some
    of the discussions about getting MLS working for the RedHat LSP
    before you go throwing "just" around.

    Casey Schaufler
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-06-09 20:41    [W:0.019 / U:22.916 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site