On Sat, Nov 10, 2007 at 05:27:51PM -0800, david@lang.hm wrote:
quoted text
> On Sat, 10 Nov 2007, Alan Cox wrote:
>
>>> but how can the system know if the directory the user wants to add is
>>> reasonable or not? what if the user says they want to store their
>>> documents in /etc?
>>
>> A more clear example is wanting to wrap a specific tool with temporary
>> rules. Those rules would depend on the exact file being edited at this
>> moment - something root cannot know in advance
>> (although with apparmor I guess mv $my_file apparmour_magic.name ; foo;
>> mv it back might work 8))
>
> the mechanism being desired was that the system administrator would setup=
 a=20
quoted text
> restrictive policy and a user who wanted a more permissive policy would=
=20
quoted text
> have the ability to make it more permissive.
>
> this sort of thing is a disaster waiting to happen.
>
yep

quoted text
> however, if App Armor sets things up so that there can be a system policy=
=20
quoted text
> that users cannot touch, but users can have a secondary policy that layer=
s=20
quoted text
> over the system one to restrict things further it could be safe.
>
> if a sysadmin wants to have 'soft' and 'hard' limits of what a user can d=
o,=20
quoted text
> they could put the 'hard' limits in the system policy (and the users=20
> _cannot_ violate these limits), and then set the 'soft' limits in the use=
rs=20
quoted text
> default setup (similar to how .profile is set by default). if a user want=
s=20
quoted text
> to make things less restrictive they could edit or remove the per-user=20
> policy, but would still not be able to violate the system policy.
>
> however, while this seems attractive, I'm not sure that madness isn't dow=
n=20
quoted text
> the road a little bit. since the users policy would only apply to=20
> themselves, you have the situation that (DAC permissions permitting) the=
=20
quoted text
> files are available to other confined processes becouse they are running =
as=20
quoted text
> other users. this sort of thing will surprise people if the explinations=
=20
quoted text
> aren't done very carefully.
>
yes, the devil is in the details.