Re: Some Concrete AppArmor Questions - was Re: [RFC][PATCH 0/11] security: AppArmor - Overview

[Stephen Hemminger <shemminger@osdl.org>]

On Fri, 28 Apr 2006 08:49:27 -0700 (PDT)
Casey Schaufler <casey@schaufler-ca.com> wrote:

> 
> 
> --- Stephen Smalley <sds@tycho.nsa.gov> wrote:
> 
> 
> > But this is a temporary situation, until we have the
> > infrastructure and
> > tools developed to make MAC truly manageable by
> > typical end users.  Not
> > an inherent problem.
> 
> Oh come on! I've been hearing that saw continueously
> since 1987. Mandatory MAC (as opposed to targeted MAC)
> is hard on sysadmins. It will remain so. SELinux,
> Trusted Solaris, Trusted IRIX, and anyone else are all
> a pain in the bum and will remain so. Tools are going
> to help only to a limited extent, they never make all
> the pain go away. Smarter people than I have been
> working on the problem for 20 years and I believe that
> it's safe to say there is no magic wand that will
> make the problems all go away.
> 
> I like MAC. I like the Iron Fist approach to software
> security. I just don't believe that there's a glove
> with velvet thick enough to please the masses.
> 

The problem I see looking from the outside at this discussion is that
SELinux and AppArmor have two different goals. AppArmor like no-execute
is more targeted at preventing an existing application with well defined
behavior from doing something wrong.  Like other tools of this type:
virus scanners, etc; it works to prevent the known good applications
from turning rogue. The problem is that listing all the allowed behavior
for all applications would be impossible.

SELinux on the other hand takes a real security view of the world. If
you have ever worked with real security environment with "need to
know", you will understand that it is hard to keep secure and requires
too many restrictions for normal users.