| 2015-04-15 20:45:15 |
John Johansen |
description |
It would be nice to have the ability to place static labels on files. I know that John has given this some thought in how it plays into existing AppArmor policy. The rules would look something like:
label=foo rw,
or
file label=bar r, |
It would be nice to have the ability to place static labels on files and make rules conditional upon the existence of a given label.
A rule can grant permission conditionally based on the label= conditional.
Eg.
label=foo rw, # a generic access rule for any rule type that maps rw permissions, so file, network, unix, ...
file label=bar r, # only allow r access to files with label of bar
The label on an object can be set via an assignment rule.
file create label:=foo /dev/bar,
The labels are stored in the security xattr. |
|
