Re: AppArmor FAQ

Bernd Eckenfels
2007-04-19T18:19:54Z

In article <Line.LNX.4.64.0704180935100.25495@d.namei> you wrote:
> Perhaps -- until your httpd is compromised via a buffer overflow or
> simply misbehaves due to a software or configuration flaw, then the
> assumptions being made about its use of pathnames and their security
> properties are out the window.

Hu? Even a compromised httpd (especially a compromised httpd) is bound to
the app armor policies. This means it cannot (for example) write to
/var/www/* - if it never needed to at normal/profiling time.

Gruss
Bernd