I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, grsecurity, Smack.
As far as I understood, all those systems rely on setting up a catalog of rules. Those rules define finer-grained access policies for files and system resources and thus provide increased security.
Given the intent to restrict access to file, it is logical that we have to know "which" files and hence file references are essential for those rules to make sense. This is what my question is related to.
With the noticable exception of SELinux and Smack, the other approaches use file paths (pathnames) to identify the files in the rules. I have seen others judge this approach insecure, because one file could have several names at the same time (links, bind-mounting, etc).
Is the approach of using pathnames secure? What are the advantages and disadvantages of these pathname-based schemes? Would it be accurate to state that "Pathname-based MAC (such as TOMOYO, grsecurity, AppArmor, …) have a real conceptual flaw"?