David Safford wrote: > On Mon, 2007-04-16 at 20:20 -0400, James Morris wrote: > >> On Mon, 16 Apr 2007, John Johansen wrote: >> >>> Label-based security (exemplified by SELinux, and its predecessors in >>> MLS systems) attaches security policy to the data. As the data flows >>> through the system, the label sticks to the data, and so security >>> policy with respect to this data stays intact. This is a good approach >>> for ensuring secrecy, the kind of problem that intelligence agencies have. >>> >> Labels are also a good approach for ensuring integrity, which is one of >> the most fundamental aspects of the security model implemented by SELinux. >> >> Some may infer otherwise from your document. >> > In fact, I am not sure how you can provide integrity support without > labels. AppArmor confines a process, but does not effectively confine > its output files, precisely because the output files are not labeled. > Other processes are free to access the unlabeled, potentially malicious > output files without restriction. > That depends on what you mean by "integrity." It is true that AppArmor does not directly manage information flow. AppArmor assumes that if you granted write permission to /etc/resolv.conf, that you meant to do that. Whether any other process is permitted to access /etc/resolv.conf is determined by those other process's respective profiles. What AppArmor provides is a way for administrators to confine software that they have to run but do not trust. The use of pathnames means that the administrator can understand the exact meaning of the security policy, without having to do a complete labeling of the file system. The flip side of not managing information flow is that each profile is independent of every other profile. The meaning of a file is how other processes interpret it. Until then, /etc/resolv.conf is just a quaint bag of bits. What makes it special is that it is what each process gets when they open the well-known "/etc/resolv.conf". Which is why it is useful to guard which processes can read or write to /etc/resolv.conf; the name is what makes its content special, not the other way around. Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering http://novell.com "You cannot say anything that is both simple and complete."--Crispin on Goedel - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
