Messages in this thread | | | Date | Mon, 24 Apr 2006 15:04:07 +0200 | From | Pavel Machek <> | Subject | Re: [RFC][PATCH 0/11] security: AppArmor - Overview |
| |
> In the security world, there is a huge tradition of the best being the > enemy of the good --- and the best being so painful to use that people > don't want to use it, or the moment it gets in the way (either because > of performance reasons or their application does something that > requires painful configuration of the SELinux policy files), they > deconfigure it. At which point the "best" becomes useless. > > You may or may not agree with the philosophical architecture question, > but that doesn't necessarily make it "broken by design". Choice is > good; if AppArmor forces SELinux to become less painful to use and > configure, then that in the long run will be a good thing.
SELinux kernel support can _almost_ do what AA does; with notable exception of labels for new files. That can probably be fixed with patch of reasonable size (or maybe even with LD_PRELOAD library, glibc modification, or stuff like that). (There was post showing that in this long flamewar).
That way you can have SELinux that works on AA config files.
(I still dislike path-based security, but labeling patch can probably be useful for other stuff, too.) Pavel -- Thanks for all the (sleeping) penguins. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |