AppArmor doesn't actually provide confinement, because it only operates on
filesystem objects.
What you define in AppArmor policy does _not_ reflect the actual
confinement properties of the policy. Applications can simply use other
mechanisms to access objects, and the policy is effectively meaningless.
You might define this as a non-technical issue, but the fact that AppArmor
simply does not and can not work is a fairly significant consideration, I
would imagine.
- James
--
James Morris
<jmorris@namei.org>
-
