On Sat, 9 Jun 2007, Sean wrote:
On Fri, 8 Jun 2007 22:18:40 -0700 (PDT)
david@xxxxxxx wrote:
the way I would describe the difference betwen AA and SELinux is:
SELinux is like a default allow IPS system, you have to describe
EVERYTHING to the system so that it knows what to allow and what to stop.
AA is like a default deny firewall, you describe what you want to happen,
and it blocks everything else without you even having to realize that it's
there.
now I know that this isn't a perfect analyogy, that SELinux doesn't allow
something to happen unless it's been told to let it, but in terms of
complexity and the amount of work to configure things I think the analogy
is close.
It must be drop dead simple to modify SELinux to be default-deny. That
seems like it could be done in a small patch instead of requiring a huge
new infrastructure.
did you read my explination of the analogy?
Let's assume that everyone agrees that AA is a good idea. Which parts of it
absolutely can't be implemented in terms of SELinux? SELinux isn't fixed in
stone, it can be altered if necessary to accommodate AA (as in the example
above of becoming default-deny).
what SELinux cannot do is figure out what label to assign a new file.
but the bigger problem in changing SELinux to behave like AA is that the
SELinux people disagree with the concept of AA. they don't believe that
it's secure, so why would they add useless bloat that would only
complicate their code and make systems less secure? I don't happen to
agree with their opinion of AA obviously, but they have the right to their
opinion, and it is their code. why should they be asked to implement and
support something they disagree with so fundamentally?
remember that the security hooks in the kernel are not SELinux API's, they
are the Loadable Security Model API. What the AA people are asking for is
for the LSM API to be modified enough to let their code run (after that
(and working in parallel) they will work on getting the rest of their code
approved for the kernel, but the LSM hooks are the most critical)
David Lang
-
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
