On Fri, 8 Jun 2007, Greg KH wrote:
I still want to see a definition of the AA "model" that we can then use
to try to implement using whatever solution works best. As that seems
to be missing the current argument of if AA can or can not be
implemented using SELinux or something totally different should be
stopped.
the way I would describe the difference betwen AA and SELinux is:
SELinux is like a default allow IPS system, you have to describe
EVERYTHING to the system so that it knows what to allow and what to stop.
AA is like a default deny firewall, you describe what you want to happen,
and it blocks everything else without you even having to realize that it's
there.
now I know that this isn't a perfect analyogy, that SELinux doesn't allow
something to happen unless it's been told to let it, but in terms of
complexity and the amount of work to configure things I think the analogy
is close.
the fact that the SELinux policy _will_ affect the entire systems means
one of two things.
1. you have a policy that exactly describes how every part of the system
operates
or
2. you have a policy that's exessivly permissive in some parts of the
system becouse 'that works' and you either don't understand that part of
the system well enough, or don't have time to write a more complete
policy.
I would argue that with the number of files on a system nowdays (483,000
on my 'minimalistic' gentoo server, 442,000 on my slackware laptop,
800,000 on a ubuntu server at work) it's not possible to do #1, so any
deployed policy (especially one done by a disto that needs to work for all
it's users) is going to follow #2, frequently to the point where it's not
really adding much security.
David Lang
-
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
