On Thu, Jun 21, 2007 at 10:21:07PM +0200, Lars Marowsky-Bree wrote: > On 2007-06-21T22:07:40, Pavel Machek <[email protected]> wrote: > > > > > Plus IIRC we have something like "AA has to allocate path-sized > > buffers along every syscall". > > That is an implementation bug though. I'm sure we have other bugs in the > kernel too - this isn't a design flaw. > > (If people are allowed to thinair solutions for implementing AA on top > of SELinux, I can thinair that this can be solved by reverse-matching > the dentry tree against the policy as the path is traversed and > constructed, requiring a constant sized buffer.) > Indeed there are a few solutions to "fix" this implementation "bug", of which reverse matching is one. For reverse matching the policy tables would become larger. Reverse matching wouldn't need any additional buffer for enforcement but would still fall back to d_path for logging. But we would still require the changes to the vfs and also a way to safely walk the tree backwards. So we would need to either export the namespace semaphore or add a generic walking function which we could pass a hook function to.
Attachment:
pgpSVfiO3UjyB.pgp
Description: PGP signature
- References:
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Greg KH <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Pavel Machek <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Greg KH <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Crispin Cowan <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Pavel Machek <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Lars Marowsky-Bree <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Pavel Machek <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Lars Marowsky-Bree <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Pavel Machek <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- From: Lars Marowsky-Bree <[email protected]>
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Prev by Date: Re: Linux Kernel include files
- Next by Date: Re: Please release a stable kernel Linux 3.0
- Previous by thread: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Next by thread: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Index(es):