4 ms·
That's the issue with LSMs in general. They all work, but historically have been difficult to configure and impossible to maintain. That's changing. There used
by w8rbt 10y ago
That's the issue with LSMs in general. They all work, but historically have been difficult to configure and impossible to maintain. That's changing.
There used to be only one (SELinux), however, there's competition now from other LSMs. Smack, AppArmor, Tomoyo, etc. In part, that's why SELinux is improving.
I've tried them all and settled on Tomoyo. The documentation is outstanding and it is (to me at least) the easiest LSM to reason about and configure.
http://tomoyo.osdn.jp/ http://tomoyo.osdn.jp/
- jwildeboer 10y agoHow up2date is tomoyo, though? The Changelog and updates on the front page seem to indicate that not much happened after 2015.
- w8rbt 10y agoLast git commits in the Linux kernel were in 2016: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=40d273782ff16fe1a7445cc05c66a447dfea3433 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7560ef39dc0bfebba8f43766d8bb4c1ec5eb66fc https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/?id=refs%2Ftags%2Fv4.10-rc3&qt=author&q=tetsuo+handa https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....
- djsumdog 10y agoI've had to create apparmour profiles in the past. There is some good tooling, but it's still not trivial.