On Sat, 10 Nov 2007, Alan Cox wrote:
but how can the system know if the directory the user wants to add is
reasonable or not? what if the user says they want to store their
documents in /etc?
A more clear example is wanting to wrap a specific tool with temporary
rules. Those rules would depend on the exact file being edited at this
moment - something root cannot know in advance
(although with apparmor I guess mv $my_file apparmour_magic.name ; foo;
mv it back might work 8))
the mechanism being desired was that the system administrator would setup
a restrictive policy and a user who wanted a more permissive policy would
have the ability to make it more permissive.
this sort of thing is a disaster waiting to happen.
however, if App Armor sets things up so that there can be a system policy
that users cannot touch, but users can have a secondary policy that layers
over the system one to restrict things further it could be safe.
if a sysadmin wants to have 'soft' and 'hard' limits of what a user can
do, they could put the 'hard' limits in the system policy (and the users
_cannot_ violate these limits), and then set the 'soft' limits in the
users default setup (similar to how .profile is set by default). if a user
wants to make things less restrictive they could edit or remove the
per-user policy, but would still not be able to violate the system policy.
however, while this seems attractive, I'm not sure that madness isn't down
the road a little bit. since the users policy would only apply to
themselves, you have the situation that (DAC permissions permitting) the
files are available to other confined processes becouse they are running
as other users. this sort of thing will surprise people if the
explinations aren't done very carefully.
David Lang
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
