From: Pavel Machek <pavel@ucw.cz>
Subject: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
Date: Mon, 11 Jun 2007 13:00:43 +0200
Message-ID: <20070611110043.GD30166@elf.ucw.cz>
References: <700465.32295.qm@web36612.mail.mud.yahoo.com> <466C6451.6030907@novell.com> <Pine.LNX.4.64.0706102328200.6675@asgard.lang.hm>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: Crispin Cowan <crispin@novell.com>, casey@schaufler-ca.com,
	Greg KH <greg@kroah.com>, Andreas Gruenbacher <agruen@suse.de>,
	Stephen Smalley <sds@tycho.nsa.gov>, jjohansen@suse.de,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
To: david@lang.hm
Return-path: <linux-security-module-owner@vger.kernel.org>
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.64.0706102328200.6675@asgard.lang.hm>
Sender: linux-security-module-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

Hi!

> ACPI should have taught everyone that sometimes putting an interpreter in 
> the kernel really is the best option. looking at the problems of bouncing 
> back out to userspace for file creation and renames it looks like a regex 
> in the kernel is a lot safer and more reliable.

What do ACPI and AA have in common?

* they both start with A

* there are both nightmare

* they both put interpretter into kernel

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html