Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching

[John Johansen]

On Thu, Jun 21, 2007 at 10:21:07PM +0200, Lars Marowsky-Bree wrote:
> On 2007-06-21T22:07:40, Pavel Machek <pavel@xxxxxx> wrote:
> 
> > 
> > Plus IIRC we have something like "AA has to allocate path-sized
> > buffers along every syscall".
> 
> That is an implementation bug though. I'm sure we have other bugs in the
> kernel too - this isn't a design flaw. 
> 
> (If people are allowed to thinair solutions for implementing AA on top
> of SELinux, I can thinair that this can be solved by reverse-matching
> the dentry tree against the policy as the path is traversed and
> constructed, requiring a constant sized buffer.)
> 
Indeed there are a few solutions to "fix" this implementation "bug",
of which reverse matching is one.  For reverse matching the policy
tables would become larger.   Reverse matching wouldn't need any
additional buffer for enforcement but would still fall back to d_path
for logging.

But we would still require the changes to the vfs and also a way to
safely walk the tree backwards.  So we would need to either export the
namespace semaphore or add a generic walking function which we could
pass a hook function to.

Attachment: pgp00000.pgp
Description: PGP signature