Default mode for apparmor profiles : complain or enforce ?

[Mathias Gug]

On Wed, Jun 06, 2007 at 03:25:14PM +0200, David Nielsen wrote:
> It seems to defeat the purpose to have additional security capabilities
> and not let them do their job. Clearly if they stop legitimate
> functionality then that is a bug and should be reported, a tool like
> SELinux troubleshooter would greatly help user catch them for you so
> policies could be adjusted. If you set it to just log, users don't
> benefit from a more secure setup and bugs will go unnoticed making the
> entire purpose rather self defeating.
> 
In the long term, profiles should be shipped in enforce mode by default.

But for now, the profiles need to be tested. So shipping profiles in
complain mode provides a way to test them without breaking the user
system. The notification system still need some work. At the moment, audit
messages from AppArmor are logged in /var/log/messages.

--
Mathias
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-devel/attachments/20070607/0cbc6a64/attachment.pgp