From: Casey Schaufler <casey@schaufler-ca.com>
Subject: Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
Date: Sun, 10 Jun 2007 13:04:51 -0700 (PDT)
Message-ID: <700465.32295.qm@web36612.mail.mud.yahoo.com>
References: <Pine.LNX.4.64.0706100201540.6675@asgard.lang.hm>
Reply-To: casey@schaufler-ca.com
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Cc: Greg KH <greg@kroah.com>, Andreas Gruenbacher <agruen@suse.de>,
	Stephen Smalley <sds@tycho.nsa.gov>, jjohansen@suse.de,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
To: david@lang.hm, Pavel Machek <pavel@ucw.cz>
Return-path: <linux-security-module-owner@vger.kernel.org>
In-Reply-To: <Pine.LNX.4.64.0706100201540.6675@asgard.lang.hm>
Sender: linux-security-module-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org


--- david@lang.hm wrote:


> > Yes, and in the process, AA stores compiled regular expressions in
> > kernel. Ouch. I'll take "each file it's own label" over _that_ any time.
> 
> and if each file has it's own label you are going to need regex or similar 
> to deal with them as well.

Now that you're going to have to explain. Nothing like that 
on any of the MLS systems I'm familiar with, and I think that
I know just about all of them.


Casey Schaufler
casey@schaufler-ca.com