Re: AppArmor FAQ

[daw@cs.berkeley.edu (David Wagner)]

James Morris  wrote:
>On Tue, 17 Apr 2007, David Wagner wrote:
>> Maybe you'd like to confine the PHP interpreter to limit what it can do.
>> That might be a good application for something like AppArmor.  You don't
>> need comprehensive information flow control for that kind of use, and
>> it would likely just get in the way.
>
>SELinux can do this, it's policy-flexible.  You can even simulate a 
>pathame-based policy language with a consequential loss of control:

I have no doubt that SELinux can do that, but that has about as much
relevance to my point as the price of tea in China does.  I can use a
screwdriver to drive in a nail into my wall, too, if I really wanted to,
but that doesn't mean toolmakers should stop manufacturing hammers.

My point is that there are some tasks where it's plausible that AppArmor
might well be a better (easier-to-use) tool for the job.  I'm inclined
to suspect I might find it easier to use AppArmor for this kind of task
than SELinux, and I suspect I'm not the only one.  That doesn't mean
that AppArmor is somehow inherently superior to SELinux, or something
like that.

No one is claiming that AppArmor is "a better SELinux".  It solves
a somewhat different problem, and has a different set of tradeoffs.
It seems potentially useful.  That ought to be enough.  The world does
not revolve around SELinux.