lkml.org 
[lkml]   [2007]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
    On Fri, 15 Jun 2007, Casey Schaufler wrote:

    >
    > --- James Morris <jmorris@namei.org> wrote:
    >
    > > On my system, it takes about 1.2 seconds to label a fully checked out
    > > kernel source tree with ~23,000 files in this manner
    >
    > That's an eternity for that many files to be improperly labeled.
    > If, and the "if" didn't originate with me, your policy is
    > demonstrably correct (how do you do that?) for all domains
    > you could claim that the action is safe, if not ideal.
    > I can't say if an evaluation team would buy the "safe"
    > argument. They've been known to balk before.

    To clarify:

    We are discussing a scheme where the underlying SELinux labeling policy
    always ensures a safe label on a file, and then relabeling newly created
    files according to their pathnames.

    There is no expectation that this scheme would be submitted for
    certification. Its purpose is to merely to provide pathname-based
    labeling outside of the kernel.



    - James
    --
    James Morris
    <jmorris@namei.org>
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-16 05:41    [W:2.733 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site