lkml.org 
[lkml]   [2007]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook
> >> honest, even average-level system administrators should not be  
> >> writing security policy.
> That explains so much! "SELinux: you're too dumb to use it, so just keep
> your hands in your pockets." :-)

Hardly. And there are helper tools
>
> AppArmor was designed to allow your average sys admin to write a
> security policy.

Which is a bit like giving a small child an Uzi 9mm and inviting them to
teach themselves to shoot.

> Both SELinux and AppArmor can be configured so tightly that you are not
> going to get to install malware, by preventing the user from installing
> software. This isn't what users want, so they invariably bypass security
> and install shiny things if they own the box. SELinux and AppArmor can't
> help but fail if you put them in that kind of harm's way.

That depends who owns the admin password. That kind of thing (coupled
with 'can install approved packages' and suitable policy) works very well
in some environments where the user doesn't get the admin password - ie
much of business.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-05-30 12:09    [W:0.162 / U:0.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site