On Fri, 8 Jun 2007 22:18:40 -0700 (PDT) david@xxxxxxx wrote: > the way I would describe the difference betwen AA and SELinux is: > > SELinux is like a default allow IPS system, you have to describe > EVERYTHING to the system so that it knows what to allow and what to stop. > > AA is like a default deny firewall, you describe what you want to happen, > and it blocks everything else without you even having to realize that it's > there. > > now I know that this isn't a perfect analyogy, that SELinux doesn't allow > something to happen unless it's been told to let it, but in terms of > complexity and the amount of work to configure things I think the analogy > is close. It must be drop dead simple to modify SELinux to be default-deny. That seems like it could be done in a small patch instead of requiring a huge new infrastructure. Let's assume that everyone agrees that AA is a good idea. Which parts of it absolutely can't be implemented in terms of SELinux? SELinux isn't fixed in stone, it can be altered if necessary to accommodate AA (as in the example above of becoming default-deny). Sean. - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
