linux-kernel - Re: [AppArmor 01/41] Pass struct vfsmount to the inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070528203838.GB5840@ucw.cz>
Date:	Mon, 28 May 2007 20:38:38 +0000
From:	Pavel Machek <pavel@....cz>
To:	Kyle Moffett <mrmacman_g4@....com>
Cc:	Valdis.Kletnieks@...edu, Toshiharu Harada <haradats@...il.com>,
	James Morris <jmorris@...ei.org>, casey@...aufler-ca.com,
	Andreas Gruenbacher <agruen@...e.de>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook

Hi!

> >>That's a circular argument, and a fairly trivial one 
> >>at that.  If you
> >>can't properly manage your labels, then how do you 
> >>expect any
> >>security at all?
> >
> >Unfortunately, it's not at all as simple as all that. 
> >Toshiharu is  quite correct that it isn't always easy 
> >to actually implement.   Consider how many ad-croc 
> >usages of 'restorecon' are needed to get  a Fedora 
> >SELinux box through rc.sysinit:
> 
> While I don't think restorecon is really necessary to 
> properly boot  SELinux-enabled (I've got a Debian box 
> with some heavily customized  policy which does so just 
> fine), I am of the opinion that adding a  "name" 
> parameter to the file/directory create actions would be  
> useful.  For example, with such support you could 
> actually specify a  type-transition rule conditional on 
> a specific name or substring:
> 
> named_type_transition sshd_t tmp_t:sock_file prefix 
> "ssh-" ssh_sock_t;
> 
> Useful options for matching would be "prefix", "suffix", 
> "substr (start,len)".  "regex" would be nice but is 
> sorta computationally  intensive and would be likely to 
> cause more problems than it solves.

Could someone implement this? AFAICT that prevents SELinux from being
superset of AppArmor... Doing this should be significantly simpler
than whole AA, and hopefully it will end up less ugly, too.
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/