Re: AppArmor FAQ

[Pavel Machek <pavel@ucw.cz>]

Hi!

> >> Some may infer otherwise from your document.
> >>     
> > Not only that, the implication that secrecy is only useful to
> > intelligence agencies is pretty funny.
> That was not the claim. Rather, that intelligence agencies have a very
> strong need for privacy, and will go to greater lengths to get it,
> including using MLS systems. I contend that while most organizations
> want privacy, they don't want it so badly that they will put up with
> MLS, and so are looking for a more tolerable form of security.
> 
> This is relevant here because information flow is the main advantage of
> labels over pathnames for access control. AppArmor does not attempt to
> manage information flow, allowing it to use pathnames to achieve ease of
> use. If you want information flow control, then by all means use a

As SEEdit shows, you can still have ease-of-use with system capable of
MLS.... so don't try to paint is as "pathnames are neccessary so it is
easy to use".

Just extend SELinux to handle new files.
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html