linux-kernel - Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation,pathname matching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <637419.18785.qm@web36615.mail.mud.yahoo.com>
Date:	Sat, 9 Jun 2007 11:37:29 -0700 (PDT)
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Sean <seanlkml@...patico.ca>, david@...g.hm
Cc:	Tetsuo Handa <from-lsm@...ove.SAKURA.ne.jp>,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation,pathname matching

--- Sean <seanlkml@...patico.ca> wrote:

> The question is: why not just extend SELinux to include AA functionality
> rather than doing a whole new subsystem.

Because, as hard as it seems for some people to believe,
not everyone wants Type Enforcement. SELinux is a fine
implementation of type enforcement, but if you don't want
what it does it would be silly to require that it be
used in order to accomplish something else, like name based
access control.

If the same things made everyone feel "secure" there would be
no optional security facilities (audit, cryptfs, /dev/random, ACLs).
It appears that the AA folks are sufficiently unimpressed with
SELinux they want to do something different. I understand that
there is a contingent that believes security == SELinux. 
There are also people who believe security == cryptography or
security == virus scanners. I'm happy that they have found what
works for them.

Also, "just extend" implies that it would be easy to do. I
suggest you go read the SELinux MLS code, and go read some
of the discussions about getting MLS working for the RedHat LSP
before you go throwing "just" around.

Casey Schaufler
casey@...aufler-ca.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/