From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Subject: Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM
 hook
Date: Wed, 30 May 2007 11:06:58 +0100
Message-ID: <20070530110658.31460b2b@the-village.bc.nu>
References: <309300.41401.qm@web36615.mail.mud.yahoo.com>
	<B4A3C582-68F9-4077-B058-03B79A5577EB@mac.com>
	<Line.LNX.4.64.0705261442000.23020@d.namei>
	<9d732d950705261608j4bc72cd4s4378df9848101c84@mail.gmail.com>
	<EC769668-ED57-4D6D-80B2-1BFD039E113C@mac.com>
	<9d732d950705270025p1bedae23ne137f024eb78886f@mail.gmail.com>
	<4F828E03-DA6B-484E-A8F2-885D1BC6F23E@mac.com>
	<9d732d950705280341x78575d85kaf95b0e2884723f3@mail.gmail.com>
	<69A10107-78FE-4F11-AF52-9B8F648AFC0A@mac.com>
	<8219.1180473430@turing-police.cc.vt.edu>
	<465D111C.6060500@novell.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: Valdis.Kletnieks@vt.edu, Kyle Moffett <mrmacman_g4@mac.com>,
	Toshiharu Harada <haradats@gmail.com>,
	James Morris <jmorris@namei.org>, casey@schaufler-ca.com,
	Andreas Gruenbacher <agruen@suse.de>,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
To: Crispin Cowan <crispin@novell.com>
Return-path: <linux-security-module-owner@vger.kernel.org>
In-Reply-To: <465D111C.6060500@novell.com>
Sender: linux-security-module-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

> >> honest, even average-level system administrators should not be  
> >> writing security policy.
> That explains so much! "SELinux: you're too dumb to use it, so just keep
> your hands in your pockets." :-)

Hardly. And there are helper tools
> 
> AppArmor was designed to allow your average sys admin to write a
> security policy. 

Which is a bit like giving a small child an Uzi 9mm and inviting them to
teach themselves to shoot.

> Both SELinux and AppArmor can be configured so tightly that you are not
> going to get to install malware, by preventing the user from installing
> software. This isn't what users want, so they invariably bypass security
> and install shiny things if they own the box. SELinux and AppArmor can't
> help but fail if you put them in that kind of harm's way.

That depends who owns the admin password. That kind of thing (coupled
with 'can install approved packages' and suitable policy) works very well
in some environments where the user doesn't get the admin password - ie
much of business.