On Wed, 2007-06-13 at 16:32 -0700, william(at)elan.net wrote: > On Thu, 14 Jun 2007, Toshiharu Harada wrote: > > > 2007/6/14, Rik van Riel <[EMAIL PROTECTED]>: > >> Toshiharu Harada wrote: > >> > 2007/6/14, Rik van Riel <[EMAIL PROTECTED]>: > >> > SELinux has a well designed robust and flexible functions. > >> > So it should be used for everywhere. I understand it. > >> > As you mentioned one can analyze the system (process) > >> > behaviors from AVC logs. But the maintenance cost is not trivial. > >> > > >> > If logging with process context is the only purpose, > >> > current TOMOYO Linux can do it with no hustle at all. > >> > >> Yes, but so does standard SELinux. > >> > >> You are making me curious: what does TOMOYO do that is > >> not done by regular SELinux? > >> > >> Logging with process name, path name and contexts is > >> already done. I must have missed some other TOMOYO > >> feature in your initial email... > > > > I see SELinux can log with process name, path name and > > contexts, but "contexts" must be defined beforehand. > > TOMOYO Linux kernel does that with pathname, so no > > label definitions needed. > > You can confirm the process (domain) transitions any time > > and access occurred are clarified per domain basis automatically. > > Security context in TOMOYO Linux is represented and stored > > as a call chain and very intuitive. > > > > TOMOYO Linux has a mode called "learning" > > in addition to "permissive" and "enforce". You can easily > > get the TOMOYO Linux policy with learning mode that > > SELinux does not have. In addition, access control mode of > > TOMOYO Linux can be managed for every difference domain. > > This sounds a like like feature differences "compared" at: > http://www.novell.com/linux/security/apparmor/selinux_comparison.html
Amazing, per that table, AppArmor is better in every way than SELinux. Nothing like an unbiased and fair-minded comparison. -- Stephen Smalley National Security Agency - To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
