Valdis.Kletnieks@xxxxxx wrote: > On Mon, 28 May 2007 21:54:46 EDT, Kyle Moffett said: > >> Average users are not supposed to be writing security policy. To be >> honest, even average-level system administrators should not be >> writing security policy. That explains so much! "SELinux: you're too dumb to use it, so just keep your hands in your pockets." :-) AppArmor was designed to allow your average sys admin to write a security policy. It makes different design choices than SELinux to achieve that goal. As a result, AppArmor is an utter failure when compared to SELinux's goals, and SELinux in turn is an utter failure when compared to AppArmor's goals. Which is why we have LSM: so we don't have to have this argument here, again. >> It's OK for such sysadmins to tweak >> existing policy to give access to additional web-docs or such, but >> only expert sysadmin/developers or security professionals should be >> writing security policy. It's just too damn easy to get completely >> wrong. >> > The single biggest challenge in computer security at the present time is how to > build *and deploy* servers that stay reasonably secure even when run by the > average wave-a-dead-chicken sysadmin, and desktop-class boxes that can survive > the best attempts of Joe Sixpack's "Ooh shiny" reflex, and Joe's kid's attempts > to evade the nannyware that Joe had somebody install. > That is a tall order. You can mostly achieve it by not giving the user the root password, but I'm not sure you would like the result :-) Both SELinux and AppArmor can be configured so tightly that you are not going to get to install malware, by preventing the user from installing software. This isn't what users want, so they invariably bypass security and install shiny things if they own the box. SELinux and AppArmor can't help but fail if you put them in that kind of harm's way. Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering http://novell.com Security: It's not linear - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
