linux-kernel - Re: [AppArmor 39/45] AppArmor: Profile loading andmanipulation,pathname matching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 9 Jun 2007 07:35:56 -0400
From:	Sean <seanlkml@...patico.ca>
To:	Tetsuo Handa <from-lsm@...ove.SAKURA.ne.jp>
Cc:	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [AppArmor 39/45] AppArmor: Profile loading
 andmanipulation,pathname matching

On Sat, 9 Jun 2007 20:26:57 +0900
Tetsuo Handa <from-lsm@...ove.SAKURA.ne.jp> wrote:

> Sean wrote:
> > All of a sudden you've implemented the main features of AA with very
> > few changes to the kernel.  It should be more maintainable, and much
> > easier to get accepted into the kernel.
> Do you agree with passing "struct vfsmount" to VFS helper functions and LSM hooks
> and introducing d_namespace_path() so that the AA extension can calculate the requested pathname
> and map the requested pathname to SELinux's labels?
> 

Frankly i'm not in a position to judge, but if that's the best way to provide
the desired functionality, then it sounds good.  But please make sure you
bounce this all off someone who actually knows what they're talking about. ;o)
Really I was just casually following along this ongoing conversation and had
a more conceptual/design question about how things were implemented.  A few
people explained how AA labelling at "runtime" wasn't conceptually very
different than what SELinux did.  All that begged the question as to why 
that functionality couldn't just be tacked on to SELinux?

Sean
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/