Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching

On Thu, 21 Jun 2007, Lars Marowsky-Bree wrote:

> A veto is not a technical argument. All technical arguments (except for
> "path name is ugly, yuk yuk!") have been addressed, have they not?

AppArmor doesn't actually provide confinement, because it only operates on 
filesystem objects.

What you define in AppArmor policy does _not_ reflect the actual 
confinement properties of the policy.  Applications can simply use other 
mechanisms to access objects, and the policy is effectively meaningless.

You might define this as a non-technical issue, but the fact that AppArmor 
simply does not and can not work is a fairly significant consideration, I 
would imagine.



- James
-- 
James Morris
<[email protected]>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Lars Marowsky-Bree <[email protected]>

• References:
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Andreas Gruenbacher <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Greg KH <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Crispin Cowan <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Greg KH <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Pavel Machek <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Greg KH <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Crispin Cowan <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Pavel Machek <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Lars Marowsky-Bree <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Pavel Machek <[email protected]>
  • Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    • From: Lars Marowsky-Bree <[email protected]>

• Prev by Date: Re: [PATCH] trim memory not covered by WB MTRRs
• Next by Date: Re: Adding subroot information to /proc/mounts, or obtaining that through other means
• Previous by thread: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
• Next by thread: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]