Jamie, Am 07.12.2011 um 15:31 schrieb Jamie Strandboge:
> Hadmut, we have been through this before-- Yes. And I would highly appreciate if you'd remember that last time I finally won because of the better arguments. You could save your and my valuable time if you wouldn't start the same discussion over and over again, and recall previous results and improvements instead. > Ubuntu is a general purpose > distribution and we cannot deny access to all files in the manner you > keep suggesting because people will just turn off apparmor altogether And you're repeating the same mistake again and again. As usual you totally missed the point and closed the bug before you understood it. I don't ask you to make apparmor config more tight. I totally agree with you that it should remain in a state where it works for the non-experts. I ask you to split it in two parts. The part that does not need user configuration (i.e. to read /usr/lib and such things needed to get the software up and running), and the other part that opens multimedia files at runtime, because that's the part that security-aware users might modify to match their individual needs. BTW., that's exactly the reason why I put both bug reports into one, because I hoped it would help understanding why there is need to split that in two separate files. On one hand, the parts depending on the operating system (like /udev, /usr/lib,...) which is the same on all machines, should not be modified manually because once modified the debian/ubuntu package system refuses (or at least has problems) to upgrade files in /etc/... So there's no clean and smooth way to configure security to local needs without beeing cut from updates and bug fixes (like the one with the /udev thing). But if you were splitting that in a general part and a separate part describing the run time access rules (like $HOME/** ), one could configure the latter without touching the former and thus still get all updates with new packages. The last time when we had the same problem with a different package, it was a lot of hard work and took me a heap of ugly swear words to convince the ubuntu crew. Why is that so difficult to understand and why do I have to explain that from scratch again and again? Why is it that difficult to understand that I do not ask you to make ubuntu more tight, but to split the configuration into two parts to allow users to make it more tight if they want without breaking the package updates? Why the hell do you force people to break updates if they want more than just zero security? Hadmut -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/900324 Title: apparmor profile provides too much access To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/evince/+bug/900324/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
