3 ms·
It is also the reason why most common advice is to just turn off SELinux. It blocks valid (although sometimes weird) usage, because someone else decided that 90
by Elhana 10y ago
It is also the reason why most common advice is to just turn off SELinux. It blocks valid (although sometimes weird) usage, because someone else decided that 90% of users should not do something.
Developer knows better what program should and should not do and is much more capable to set this kind of rules with pledge.
- digi_owl 10y agoLets not forget that SELinux came out of the defensive side of NSA. Its to block attacks to government systems from both outside and inside. In essence it is the concept of "trusted computing" given form. And that concept in turn means that a general can put a trusted system into hostile territory and trust it to not leak secrets. And NSA still care for it. Around the time of the last kdbus dustup, someone from NSA voice a worry about how kdbus would compromise certain parts of SELinux.