lkml.org 
[lkml]   [2007]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    On Sat, 9 Jun 2007 00:13:22 -0700 (PDT)
    david@lang.hm wrote:

    > did you read my explination of the analogy?

    It was a rather poor analogy i'm afraid. But the point i make still stands.
    So far you've failed to show any reason SELinux can't be reasonably extended
    to handle all the features you care about.

    > what SELinux cannot do is figure out what label to assign a new file.

    That would be the job of your AA extension.

    > but the bigger problem in changing SELinux to behave like AA is that the
    > SELinux people disagree with the concept of AA. they don't believe that
    > it's secure, so why would they add useless bloat that would only
    > complicate their code and make systems less secure? I don't happen to
    > agree with their opinion of AA obviously, but they have the right to their
    > opinion, and it is their code. why should they be asked to implement and
    > support something they disagree with so fundamentally?

    So now you're claiming the real reason to let AA into the kernel is
    politics?

    Just show that the feature can be easily added to SELinux and made as an
    option for the end user to choose and it should go a long way to silencing
    the opponents.

    >
    > remember that the security hooks in the kernel are not SELinux API's, they
    > are the Loadable Security Model API. What the AA people are asking for is
    > for the LSM API to be modified enough to let their code run (after that
    > (and working in parallel) they will work on getting the rest of their code
    > approved for the kernel, but the LSM hooks are the most critical)

    Remember that the SELinux API's essentially belong to everyone under the GPL.
    So its not an excuse for falling into NIH syndrome and putting a bunch of
    new stuff into the kernel that could instead be added as a small
    extension to what already exists.

    Sean

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-09 09:39    [W:2.863 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site