Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching

[david@lang.hm]

On Fri, 8 Jun 2007, Greg KH wrote:

> I still want to see a definition of the AA "model" that we can then use
> to try to implement using whatever solution works best.  As that seems
> to be missing the current argument of if AA can or can not be
> implemented using SELinux or something totally different should be
> stopped.

the way I would describe the difference betwen AA and SELinux is:

SELinux is like a default allow IPS system, you have to describe 
EVERYTHING to the system so that it knows what to allow and what to stop.

AA is like a default deny firewall, you describe what you want to happen, 
and it blocks everything else without you even having to realize that it's 
there.

now I know that this isn't a perfect analyogy, that SELinux doesn't allow 
something to happen unless it's been told to let it, but in terms of 
complexity and the amount of work to configure things I think the analogy 
is close.


the fact that the SELinux policy _will_ affect the entire systems means 
one of two things.

1. you have a policy that exactly describes how every part of the system 
operates

or

2. you have a policy that's exessivly permissive in some parts of the 
system becouse 'that works' and you either don't understand that part of 
the system well enough, or don't have time to write a more complete 
policy.

I would argue that with the number of files on a system nowdays (483,000 
on my 'minimalistic' gentoo server, 442,000 on my slackware laptop, 
800,000 on a ubuntu server at work) it's not possible to do #1, so any 
deployed policy (especially one done by a disto that needs to work for all 
it's users) is going to follow #2, frequently to the point where it's not 
really adding much security.

David Lang