Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: david
Date: Sunday, June 10, 2007 - 11:27 pm

On Sun, 10 Jun 2007, Pavel Machek wrote:


then the kernel is going to have to call out to userspace every time a 
file is created or renamed and the policy is going to be enforced 
incorrectly until userspace finished labeling/relabeling whatever is 
moved. building this sort of race condigion for security into the kernel 
is highly questionable at best.


see Linus' rants about why it's not automaticaly the best thing to move 
functionality into userspace.

remember that the files covered by an AA policy can change as files are 
renamed. this isn't the case with SELinux so it doesn't have this sort of 
problem.

David Lang
-
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Mon Jun 4, 2:03 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Fri Jun 8, 3:03 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Sat Jun 9, 8:05 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Sat Jun 9, 8:17 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., david, (Sun Jun 10, 11:27 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Tue Jun 12, 10:03 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Thu Jun 21, 8:54 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Thu Jun 21, 9:01 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 9:08 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 12:24 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 12:35 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 12:54 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 1:21 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 2:17 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Thu Jun 21, 5:19 pm)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Andreas Gruenbacher, (Fri Jun 22, 2:59 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Fri Jun 22, 3:49 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Fri Jun 22, 4:37 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Fri Jun 22, 5:42 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Fri Jun 22, 5:54 am)
Re: [AppArmor 39/45] AppArmor: Profile loading and manipul ..., Lars Marowsky-Bree, (Tue Jun 26, 1:50 am)