Re: AppArmor FAQ

James Morris
2007-04-19T20:19:10Z

On Thu, 19 Apr 2007, Bernd Eckenfels wrote:

> In article <Line.LNX.4.64.0704180935100.25495@d.namei> you wrote:
> > Perhaps -- until your httpd is compromised via a buffer overflow or
> > simply misbehaves due to a software or configuration flaw, then the
> > assumptions being made about its use of pathnames and their security
> > properties are out the window.
>
> Hu? Even a compromised httpd (especially a compromised httpd) is bound to
> the app armor policies. This means it cannot (for example) write to
> /var/www/* - if it never needed to at normal/profiling time.

This has been addressed several times already, please read the full
thread.

- James
--
James Morris
<jmorris@namei.org>