lkml.org 
[lkml]   [2012]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subjectsecurity_path hooks for xattr
Date
Forwarding from an internal bug report:

"AppArmor does not mediate the xattr system calls for confined processes.

As a consequence, a confined process can cross the confinement privilege
boundary by reading or writing to extended attributes that the confined
task should not have access to. The restrictions for security and user
attributes read and write still apply according to DAC; however, this
does not comply with the claim of AppArmor to mediate fipe
operations. The use of extended attributes is very flexible, so that the
effect of a missing mediation can lead to false assumptions in
subsequent policy decisions (eCryptfs)."

AFAIU this boils down to missing security hooks in *xattr().

Would it be possible to add these hooks?

Thanks,
Miklos


\
 
 \ /
  Last update: 2012-01-26 13:47    [W:0.036 / U:1.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site