Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook

James Morris
2007-05-26T18:45:41Z

On Sat, 26 May 2007, Kyle Moffett wrote:

> AppArmor). On the other hand, if you actually want to protect the _data_,
> then tagging the _name_ is flawed; tag the *DATA* instead.

Bingo.

(This is how traditional Unix DAC has always functioned, and is what
SELinux does: object labeling).

- James
--
James Morris
<jmorris@namei.org>