| |||||||||||||
SELinux and AppArmorSELinux and AppArmorPosted Oct 16, 2009 20:08 UTC (Fri) by nix (subscriber, #2304)In reply to: SELinux and AppArmor by rahulsundaram Parent article: Walsh: Google Chrome Policy
I suppose it doesn't have any developers because SuSE fired all its
developers and its main developer went to work for Microsoft.
Oh, also because the SELinux people fought tooth and nail to keep it out
Some prophecies are self-fulfilling.
(Log in to post comments)
SELinux and AppArmor Posted Oct 16, 2009 20:20 UTC (Fri) by dlang (✭ supporter ✭, #313) [Link]
canonical has people working on AppArmor, so it's not quite 'no developers' any more.
but the tooth and nail fight to keep it out of the kernel would do a lot to discourage development.
SELinux and AppArmor Posted Oct 17, 2009 0:48 UTC (Sat) by rahulsundaram (subscriber, #21946) [Link]
That's hilariously wrong. James Morris, SELinux developer at Red Hat is the security sub-system maintainer in the upstream kernel and he has not only accepted alternatives to SELinux and merged them, he also regularly blogs about progress and even expressed hope that AppArmor would get merged
SELinux and AppArmor Posted Oct 17, 2009 2:18 UTC (Sat) by dlang (✭ supporter ✭, #313) [Link]
I will admit that I do not remember James objecting, but he also hasn't been saying anything to disagree with Stephen Smalley (the other SELinux maintainer) who has been _very_ vocal in his opposition.
SELinux and AppArmor Posted Oct 17, 2009 3:04 UTC (Sat) by rahulsundaram (subscriber, #21946) [Link]
Stephen Smalley is one of the many SELinux developers but his objections were pretty specific. Some of them were even addressed in subsequent versions of the patch set. I don't see any reasons to object to valid technical criticism.
SELinux and AppArmor Posted Oct 17, 2009 3:19 UTC (Sat) by dlang (✭ supporter ✭, #313) [Link]
I don't object to valid technical criticism.
however when that becomes 'it doesn't handle this case that SELinux does, so it must be worthless', that stops being valid technical criticism, and the objections have frequently gotten to that stage (and, no, my memory is not good enough to remember exactly who made which objections)
SELinux and AppArmor Posted Oct 17, 2009 3:44 UTC (Sat) by rahulsundaram (subscriber, #21946) [Link]
It seems you are badly paraphrasing comments elsewhere. If you point a specific link, it would be useful to know what was actually said. Some of the discussions involved the problem that the goals described the developers while submitting the patchset didn't match the patches.
It is ok for a security solution to address a specific subset of the problems while leaving others as outside the scope but the documentation should explicitly say so. If it doesn't then it makes it harder to merge those patches. Smack did a good job of describing the scope of the problem it was trying to address.
|
|||||||||||||