Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.debian.kernel > #59505

Re: recommends for apparmor in newest linux-image-4.13

From Christoph Hellwig <hch@lst.de>
Newsgroups linux.debian.kernel, linux.debian.devel
Subject Re: recommends for apparmor in newest linux-image-4.13
Date 2017-11-28 20:20 +0100
Message-ID <uQTAe-74X-5@gated-at.bofh.it> (permalink)
References (1 earlier) <uP0cO-67h-11@gated-at.bofh.it> <uP0mt-6pO-3@gated-at.bofh.it> <uP0mt-6pO-1@gated-at.bofh.it> <uP0wa-6t4-11@gated-at.bofh.it> <uP1iy-70e-9@gated-at.bofh.it>
Organization linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw


On Thu, Nov 23, 2017 at 03:43:10PM +0100, Lars Wirzenius wrote:
> 
> do you think you could manage to either point the general -devel
> reading population to a discussion of why using AppArmor by default is
> horrible news, or write that yourself? That would seem to be more
> constructive than you just showing up after months of discussion
> saying it's horrible news.

It's just a bad idea of a security model that implements ad-hoc
and mostly path based restrictions instead of an actually verified
security model.  Using that by default makes it much harder to actually
use a real MAC based security model, which not only is required for
various security sensitive deployments but also a good idea in general.

Last but not least apparmor had various issues where certain distros
shipped non-upstream features that later turned out to be incompatible
with what went upstream.

Back to linux.debian.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

recommends for apparmor in newest linux-image-4.13 Christoph Hellwig <hch@lst.de> - 2017-11-23 14:50 +0100
  Re: recommends for apparmor in newest linux-image-4.13 Ben Hutchings <ben@decadent.org.uk> - 2017-11-23 15:00 +0100
    Re: recommends for apparmor in newest linux-image-4.13 Ben Hutchings <ben@decadent.org.uk> - 2017-11-23 15:10 +0100
      Re: recommends for apparmor in newest linux-image-4.13 Christoph Hellwig <hch@lst.de> - 2017-11-23 15:20 +0100
        Re: recommends for apparmor in newest linux-image-4.13 Lars Wirzenius <liw@liw.fi> - 2017-11-23 16:10 +0100
          Re: recommends for apparmor in newest linux-image-4.13 Christoph Hellwig <hch@lst.de> - 2017-11-28 20:20 +0100
            Re: recommends for apparmor in newest linux-image-4.13 md@Linux.IT (Marco d'Itri) - 2017-11-29 00:50 +0100
              Re: recommends for apparmor in newest linux-image-4.13 Michael Stone <mstone@debian.org> - 2017-11-29 04:20 +0100
    Re: recommends for apparmor in newest linux-image-4.13 Christoph Hellwig <hch@lst.de> - 2017-11-23 15:20 +0100
  Re: recommends for apparmor in newest linux-image-4.13 Wouter Verhelst <wouter@debian.org> - 2017-11-23 15:10 +0100
    Re: recommends for apparmor in newest linux-image-4.13 maximilian attems <maks@stro.at> - 2017-11-23 16:40 +0100
      Re: recommends for apparmor in newest linux-image-4.13 Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-11-23 18:30 +0100

csiph-web