linux-kernel - Re: AppArmor FAQ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Apr 2007 19:20:59 -0400
From:	Karl MacMillan <kmacmill@...hat.com>
To:	Crispin Cowan <crispin@...ell.com>
Cc:	David Safford <safford@...son.ibm.com>,
	James Morris <jmorris@...ei.org>,
	John Johansen <jjohansen@...e.de>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: AppArmor FAQ

On Tue, 2007-04-17 at 16:09 -0700, Crispin Cowan wrote:
> David Safford wrote:
> > On Mon, 2007-04-16 at 20:20 -0400, James Morris wrote:
> >   

<snip>

> 
> The meaning of a file is how other processes interpret it. Until then,
> /etc/resolv.conf is just a quaint bag of bits. What makes it special is
> that it is what each process gets when they open the well-known
> "/etc/resolv.conf". Which is why it is useful to guard which processes
> can read or write to /etc/resolv.conf; the name is what makes its
> content special, not the other way around.
> 

This is not correct. My private ssh keys need to be protected regardless
of the file name - it is the "bag of bits" that make it important not
the name. Similarly, you protect the integrity of the applications that
need name resolution by ensuring that the data that they read is high
integrity. You do that by controlling data not the file name used to
access the data. That is James point - a comprehensive mechanism like
SELinux allows you to comprehensively protect the integrity of data.

Karl

> Crispin
> 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/