Hi!
> >>That's a circular argument, and a fairly trivial one
> >>at that. If you
> >>can't properly manage your labels, then how do you
> >>expect any
> >>security at all?
> >
> >Unfortunately, it's not at all as simple as all that.
> >Toshiharu is quite correct that it isn't always easy
> >to actually implement. Consider how many ad-croc
> >usages of 'restorecon' are needed to get a Fedora
> >SELinux box through rc.sysinit:
>
> While I don't think restorecon is really necessary to
> properly boot SELinux-enabled (I've got a Debian box
> with some heavily customized policy which does so just
> fine), I am of the opinion that adding a "name"
> parameter to the file/directory create actions would be
> useful. For example, with such support you could
> actually specify a type-transition rule conditional on
> a specific name or substring:
>
> named_type_transition sshd_t tmp_t:sock_file prefix
> "ssh-" ssh_sock_t;
>
> Useful options for matching would be "prefix", "suffix",
> "substr (start,len)". "regex" would be nice but is
> sorta computationally intensive and would be likely to
> cause more problems than it solves.
Could someone implement this? AFAICT that prevents SELinux from being
superset of AppArmor... Doing this should be significantly simpler
than whole AA, and hopefully it will end up less ugly, too.
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
