On Sat, November 10, 2007 22:04, Andi Kleen wrote: > Crispin Cowan <[EMAIL PROTECTED]> writes: > > The document should be a good base for a merge. > >> * A confined process can operate on a file descriptor passed to it >> by an unconfined process, even if it manipulates a file not in the >> confined process's profile. To block this attack, confine the >> process that passed the file descriptor. > > That is the only thing that tripped me up a bit while reading the > document. > Can you expand a bit on the reasons why the fd is not rechecked in > the context of the target process? Best do it in a new version of the > document.
You must try to considder what could actualy be a valid reason for re-checking here, and what it could accomplish. If the unconfined process A is in 'full communication' with the unconfined process B and wants B to have the 'authority' to do anything with file C that it can do, there is no way of stopping A from doing so. Stopping A from communicating its 'permission' to do so would thus be useless for that purpose. The only way of stopping A from comminucating its authority with A is stopping A from communicating with B period. Ones you accept that trying to stop delegation of authority by stopping delegation of permission is useless, you can see that ther are major advantages with respect to allowing a process with least authority, if you actualy 'accomodate' the delegation of authority. This is the main reason why I actualy feel strongly that a more extended set of delegation possibilities (both of ambient and object capabilities) would be complementary to AppArmor, in that it would allow the convenience of defining the lower bound of priviledges to a delegation based scheme, while allowing at the same time a 'thin profile' for OC aware programs. Rob J Meijer - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/