AppArmor 2.12 - The Grinch is confined!

Gianluca Frustagli am :

Hi,
even considered the existence of the "aa-teardown" command I don't think this is a good idea both from a "phylosophical" point of view and for the coherence of the systemctl set of commands.
Commands should do what it's expected they will do and people that use 'systemctl' are (or should be) used to administrative tasks, including knowing the difference between "restart" and "reload". Even the argument "but who would do that?" it's contraddictory from the simple fact that nobody know why to do "such things" until finding themselves wanting do that.
At most, if the concern is harassing, it can be preferable have 'restart' redirected to 'reload' but, at the same time, warning the user that, eventually, could choose to run 'stop' and then 'start'.

This is obviously in my opinion.

Thanks for your work.

Christian Boltz am :

I'd also prefer to be able to redirect "restart" to "reload" - but unfortunately the systemd developers didn't like the idea to implement an ExecRestart= option for unit files, which makes doing this impossible. I surely won't complain if you or someone else convinces them to change their opinion, but my hope is... limited.

Without any way to change the "restart" behaviour, "restart" always does "stop, then start" - which results in loosing AppArmor confinement from running processes if "stop" unloads the profiles.

I know and agree that breaking "stop" isn't a good idea, but it's still better than the alternative because it errors out on the safe side.

And for the "but who would do that" - I know how it sounds, and it surely includes traces of sarcasm ;-) However, using aa-complain is a much better choice because it allows everything while logging what would be denied. With that log, you can then update the profiles (manually or with aa-logprof) and ideally aa-enforce them again.

Kommentare

Ansicht der Kommentare: (Linear | Verschachtelt)

Kommentar schreiben

Name

E-Mail

Homepage

Kommentar

Antwort zu

Umschließende Sterne heben ein Wort hervor (*wort*), per _wort_ kann ein Wort unterstrichen werden.

Die angegebene E-Mail-Adresse wird nicht dargestellt, sondern nur für eventuelle Benachrichtigungen verwendet.

Um maschinelle und automatische Übertragung von Spamkommentaren zu verhindern, bitte die Zeichenfolge im dargestellten Bild in der Eingabemaske eintragen. Nur wenn die Zeichenfolge richtig eingegeben wurde, kann der Kommentar angenommen werden. Bitte beachten Sie, dass Ihr Browser Cookies unterstützen muss, um dieses Verfahren anzuwenden.
CAPTCHA