Re: AppArmor FAQ

[Karl MacMillan <kmacmill@redhat.com>]

On Tue, 2007-04-17 at 15:55 -0700, Crispin Cowan wrote:
> Karl MacMillan wrote:
> > On Mon, 2007-04-16 at 20:20 -0400, James Morris wrote:
> >   
> >> On Mon, 16 Apr 2007, John Johansen wrote:
> >>     
> >>> Label-based security (exemplified by SELinux, and its predecessors in
> >>> MLS systems) attaches security policy to the data. As the data flows
> >>> through the system, the label sticks to the data, and so security
> >>> policy with respect to this data stays intact. This is a good approach
> >>> for ensuring secrecy, the kind of problem that intelligence agencies have.
> >>>       
> >> Labels are also a good approach for ensuring integrity, which is one of 
> >> the most fundamental aspects of the security model implemented by SELinux.  
> >>
> >> Some may infer otherwise from your document.
> >>     
> > Not only that, the implication that secrecy is only useful to
> > intelligence agencies is pretty funny.
> That was not the claim.

It might not have been the claim, but I certainly think it was the
implication.

>  Rather, that intelligence agencies have a very
> strong need for privacy, and will go to greater lengths to get it,
> including using MLS systems. I contend that while most organizations
> want privacy, they don't want it so badly that they will put up with
> MLS, and so are looking for a more tolerable form of security.
> 

Definitely - which is why SELinux is primarily about type enforcement.

> This is relevant here because information flow is the main advantage of
> labels over pathnames for access control.

I would say that controlling information flow is _one_ of the main
advantages of labels. There are others.

>  AppArmor does not attempt to
> manage information flow, allowing it to use pathnames to achieve ease of
> use. If you want information flow control, then by all means use a
> label-based system.
> 

You're trying to force a false choice between "ease of use" and
"information flow control". These AppArmor / SELinux debates are
irritating enough without these kinds of misleading rhetorical
techniques.

Karl