Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook

> As such, AA can detect whether you did exec("gzip") or exec("gunzip")
> and apply the policy relevant to the program. It could apply different

That's not actually useful for programs which link the same binary to
multiple names because if you don't consider argv[0] as well I can run
/usr/bin/gzip passing argv[0] of "gunzip" and get one set of policies and
the other set of behaviour.

And then we have user added hardlinks of course.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
    • From: Andreas Gruenbacher <[email protected]>

• References:
  • Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
    • From: Casey Schaufler <[email protected]>
  • Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
    • From: Crispin Cowan <[email protected]>

• Prev by Date: 2.6.21.1 - 97% wait time on IDE operations
• Next by Date: Re: [PATCH] MIPS: Transform old-style macros to newer "__noreturn" standard.
• Previous by thread: Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
• Next by thread: Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]