Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759437AbXE2EBU (ORCPT ); Tue, 29 May 2007 00:01:20 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751113AbXE2EBK (ORCPT ); Tue, 29 May 2007 00:01:10 -0400 Received: from smtpout.mac.com ([17.250.248.186]:53664 "EHLO smtpout.mac.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1749667AbXE2EBI (ORCPT ); Tue, 29 May 2007 00:01:08 -0400 In-Reply-To: <20070528203838.GB5840@ucw.cz> References: <309300.41401.qm@web36615.mail.mud.yahoo.com> <9d732d950705261608j4bc72cd4s4378df9848101c84@mail.gmail.com> <12000.1180233422@turing-police.cc.vt.edu> <20070528203838.GB5840@ucw.cz> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Cc: Valdis.Kletnieks@vt.edu, Toshiharu Harada , James Morris , casey@schaufler-ca.com, Andreas Gruenbacher , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org Content-Transfer-Encoding: 7bit From: Kyle Moffett Subject: Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook Date: Mon, 28 May 2007 22:00:54 -0400 To: Pavel Machek X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAA== X-Brightmail-scanned: yes Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1573 Lines: 34 On May 28, 2007, at 16:38:38, Pavel Machek wrote: > Kyle Moffett wrote: >> I am of the opinion that adding a "name" parameter to the file/ >> directory create actions would be useful. For example, with such >> support you could actually specify a type-transition rule >> conditional on a specific name or substring: >> >> named_type_transition sshd_t tmp_t:sock_file prefix "ssh-" >> ssh_sock_t; >> >> Useful options for matching would be "prefix", "suffix", "substr >> (start,len)". "regex" would be nice but is sorta computationally >> intensive and would be likely to cause more problems than it solves. > > Could someone implement this? AFAICT that prevents SELinux from > being superset of AppArmor... Doing this should be significantly > simpler than whole AA, and hopefully it will end up less ugly, too. Really it would need to extend all action-match items with new "named_" equivalents, and most callbacks would need to be extended to pass in an object name, if available. On the other hand, with such support implemented then the AppArmor policy compilation tools could be transformed into a simple SELinux policy generator. I estimate that the number of new lines of kernel code for such a modified SELinux would be 100x less than the kernel code in AppArmor. Cheers, Kyle Moffett - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/