On Fri, 2007-06-22 at 13:37 +0200, Lars Marowsky-Bree wrote:
The issue arises even for a collection of collaborating confined
processes with different profiles, and the collaboration may be
intentional or unintentional (in the latter case, one of the confined
processes may be taking advantage of known behavior of another process
and shared access by both to some resource in order to induce a
particular behavior in that process).
And remember that confinement isn't just about limiting untrusted
processes but also about protecting trusted processes; limiting the
inputs and outputs of a trusted process can be just as important to
preventing exploitation.
Mandatory access control as historically understood has always meant
system-wide. As well as always being based on the security properties
of the data (so that global and persistent protection of the data is
possible). You can't actually use the terms 'mandatory access control'
or 'confinement' for AppArmor unless you redefine them.
Sorry, do you mean the "server" as in the "server system" or as in the
"server daemon"? For the former, I'd agree - we would want SELinux
policy applied on the server as well as the client to ensure that the
data is being protected consistently throughout and that the server is
not misrepresenting the security guarantees expected by the clients.
Providing an illusion of confinement on each client without any
corresponding protection on the server system would be very prone to
bypass. For the latter, the kernel can only truly confine application
code, not in-kernel threads, although we can subject the in-kernel nfsd
to permission checking as a robustness check. We've always noted that
SELinux does depend on the correctness of the kernel.
Every time we've noted an issue with AA, the answer has been that it is
out of scope. Yet the public documentation for AA misrepresents the
situation and its comparisons with SELinux conveniently ignore its
limitations.
Then yours isn't mandatory access control, nor is it confinement.
--
Stephen Smalley
National Security Agency
-
