Novell releases AppArmor
Posted Jan 17, 2006 2:43 UTC (Tue) by
etbe (subscriber, #17516)
In reply to:
Novell releases AppArmor by nix
Parent article:
Novell releases AppArmor
With SE Linux there are access controls to determine which processes can
create a hard link to a file. For example with the strict policy most
processes on the system are not permitted to create hard links to files
in /etc. I believe that some of the Common Criteria certifications
require that the system label Inodes not file names so any system that
doesn't do something similar to what SE Linux does will not do well in
certification.
In a conventional Unix system there is nothing preventing you from having
a /etc/shadow file in a chroot environment with different permissions to
the "real" one.
A bigger problem for AppArmor is the fact that file specs are relative to
the root of a file system. So /etc/shadow is equivalent
to /home/etc/shadow if /home is a separate file system.
(
Log in to post comments)
