Re: AppArmor or SELinux?

2012-06-18 Thread Claudius Hubig
Hello ~Stack~, ~Stack~ i.am.st...@gmail.com wrote: We are using it for specific services but I don't see why it would be any different setting up pidgin or opera. I have only deployed SELinux to a single Debian system and that was under Lenny. I don't recall it being problematic or anything.

Re: AppArmor or SELinux?

2012-06-18 Thread Tom H
On Sun, Jun 17, 2012 at 8:37 PM, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 15:30 -0400, Tom H wrote: Yes, but it's part of the paranoia ;) and comes withs tons of threads, on Ubuntu Precise: spinymouse@precise:~$ ps -eLf|grep console-kit-daemon|wc -l 66 It's an

Re: AppArmor or SELinux?

2012-06-18 Thread Tom H
On Sun, Jun 17, 2012 at 8:43 PM, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 15:41 -0400, Tom H wrote: On Sun, Jun 17, 2012 at 12:52 PM, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 18:45 +0200, Claudius Hubig wrote: AppArmor doesn’t add a

AppArmor or SELinux?

2012-06-17 Thread Claudius Hubig
Hello, I am running Testing/Sid amd64 with Multi-Arch enabled (i. e. Acrobat Reader and Skype from i386) on a single-user machine and here’s what I want to achieve: - Programs that process data ‘from the internet’ are only allowed to access the files they strictly need to access, plus a

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
AFAIK openSUSE and Ubuntu by default do ship with AppArmor. Dunno why our Linux installs get spammed with all that crap, such as AppArmor, ConsoleKit etc.. Reminds me to remove AppArmor from my latest Ubuntu Studio. In cases of paranoia I recommend to consult a shrink instead of installing

Re: AppArmor or SELinux?

2012-06-17 Thread Camaleón
On Sun, 17 Jun 2012 13:14:03 +0200, Claudius Hubig wrote: I am running Testing/Sid amd64 with Multi-Arch enabled (i. e. Acrobat Reader and Skype from i386) on a single-user machine and here’s what I want to achieve: - Programs that process data ‘from the internet’ are only allowed to

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
Hahaha :D women are more careful then men are. Perhaps Camaleón (as I) does know Suse ;). And IIRC Suse first ships with AppAmor. Sorry, who exactly plans a conspiracy? Regarding to the answer AppArmor might be helpful, if not, it just spam shutdown messages with crap, as it does for my

Re: AppArmor or SELinux?

2012-06-17 Thread Brian
On Sun 17 Jun 2012 at 18:00:25 +0200, Ralf Mardorf wrote: [Snip] Joe and Sam (most wanted spammers on this list) never ever will have impact to your Linux ;). Forget AppArmor! Read about ConsoleKit and other security helpers, we already run much to much threads, when running Linux.

Re: AppArmor or SELinux?

2012-06-17 Thread Claudius Hubig
that, and that’s what SELinux, AppArmor etc. are for, in my opinion: separate processes, users and files as much as possible. Complete virtual machines for each of the applications (Opera, Iceweasel, Pidgin, Skype) would a) probably break my machine’s RAM requirements b) be rather unusable c) make it much

Re: AppArmor or SELinux?

2012-06-17 Thread Claudius Hubig
and Sam (most wanted spammers on this list) never ever will have impact to your Linux ;). So what? I don’t plan to use AppArmor/SELinux as a spam filter, I don’t think you read my original email. Forget AppArmor! Read about ConsoleKit and other security helpers, we already run much to much

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
On Sun, 2012-06-17 at 17:38 +0100, Brian wrote: On Sun 17 Jun 2012 at 18:00:25 +0200, Ralf Mardorf wrote: [Snip] Joe and Sam (most wanted spammers on this list) never ever will have impact to your Linux ;). Forget AppArmor! Read about ConsoleKit and other security helpers, we already

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
On Sun, 2012-06-17 at 18:45 +0200, Claudius Hubig wrote: AppArmor doesn’t add a single thread to a running Linux system. So it's a voodoo-ghost and doesn't need resources? -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
PS: Regarding to ConsoleKit, POSIX threads? -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/1339953435.2074.65.camel@precise

Re: AppArmor or SELinux?

2012-06-17 Thread Camaleón
it make sense to switch from a running AppArmor system to a SELinux system? I'd say no again :-) As I already mentioned, both approaches look too complex to my taste. Anyway, if what you are telling me is that should you have to go with AppArmor or SELinux (yes or yes), of course I'd choose

Re: AppArmor or SELinux?

2012-06-17 Thread Tom H
On Sun, Jun 17, 2012 at 12:45 PM, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 17:38 +0100, Brian wrote: On Sun 17 Jun 2012 at 18:00:25 +0200, Ralf Mardorf wrote: Joe and Sam (most wanted spammers on this list) never ever will have impact to your Linux ;). Forget

Re: AppArmor or SELinux?

2012-06-17 Thread Claudius Hubig
Hello Ralf, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 18:45 +0200, Claudius Hubig wrote: AppArmor doesn’t add a single thread to a running Linux system. So it's a voodoo-ghost and doesn't need resources? It runs directly in the kernel, where any access control

Re: AppArmor or SELinux?

2012-06-17 Thread Tom H
On Sun, Jun 17, 2012 at 12:52 PM, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 18:45 +0200, Claudius Hubig wrote: AppArmor doesn’t add a single thread to a running Linux system. So it's a voodoo-ghost and doesn't need resources? If you think that it's using a thread,

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
On Sun, 2012-06-17 at 15:30 -0400, Tom H wrote: Yes, but it's part of the paranoia ;) and comes withs tons of threads, on Ubuntu Precise: spinymouse@precise:~$ ps -eLf|grep console-kit-daemon|wc -l 66 It's an old bug/feature: https://bugs.freedesktop.org/show_bug.cgi?id=17720

Re: AppArmor or SELinux?

2012-06-17 Thread Ralf Mardorf
On Sun, 2012-06-17 at 15:41 -0400, Tom H wrote: On Sun, Jun 17, 2012 at 12:52 PM, Ralf Mardorf ralf.mard...@alice-dsl.net wrote: On Sun, 2012-06-17 at 18:45 +0200, Claudius Hubig wrote: AppArmor doesn’t add a single thread to a running Linux system. So it's a voodoo-ghost and doesn't

Re: AppArmor or SELinux?

2012-06-17 Thread ~Stack~
Hello Claudius, I don't have a ton of experience with SELinux on Debian. However, a specific work project requires a deployment of Red Hat systems all with SELinux and I have been very impressed with how easy it is to setup and administer. I have been impressed for a while now, actually. We are