Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook

Hi,

2007/5/24, James Morris <[email protected]>:

I can restate my question and ask why you'd want a security policy like:

 Subject 'sysadmin' has:
    read access to /etc/shadow
    read/write access to /views/sysadmin/etc/shadow

where the objects referenced by the paths are identical and visible to the
subject along both paths, in keeping with your description of "policy may
allow access to some locations but not to others" ?

If I understand correctly, the original issue was whether to allow passing
vfsmount to the inode_create LSM hook or not. Which is independent from
AA or "pathname based MAC", I think.

It is proven that Linux can be used without that change,　however it is
also clear that current LSM cause the ambiguities as AA people has
explained. Clearing ambiguities is a obvious gain to Linux and will make
benefits for auditing besides "pathname based MAC".

So here's my opinion. If anybody can't explain clear reason (or needs)
to keep these ambiguities unsolved,　we should consider to merge
the proposal.

Thanks.

--
Toshiharu Harada
[email protected]
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• References:
  • [AppArmor 00/41] AppArmor security module overview
    • From: [email protected]
  • Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
    • From: Andreas Gruenbacher <[email protected]>
  • Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
    • From: James Morris <[email protected]>
  • Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
    • From: James Morris <[email protected]>

• Prev by Date: [PATCH] potential parse error in ifdef
• Next by Date: Re: [patch] x86_64: fix sched_clock()
• Previous by thread: Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
• Next by thread: [AppArmor 21/41] Add struct vfsmount parameters to vfs_rename()
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]