3 ms·
The problem is that I never had local users that might be malicious or that were prone to be hacked. The attacks for servers tend to be over the network and th
by patrickg_zill 10y ago
The problem is that I never had local users that might be malicious or that were prone to be hacked.
The attacks for servers tend to be over the network and there are many different ways to mitigate those.
- drvdevd 10y agoThis is murky because the most basic UNIX isolation mechanism (UID/GID) is applied across all parts of the system: processes, files, etc. (in a nutshell). Thus, when you run some program locally, sometimes it runs as your user/group and sometimes a new user/group is created for it. From this simple abstraction springs the issue that any (potentially misbehaving) application running locally needs to be treated as if it were a user on its own: with all the quirks a random "user" could bring like deleting files, accessing private information, and so on. Hence the need for these finer grained access control mechanisms. Any program that you download from the Internet (every program most of us run) might as well be a remote user on your system, in a sense.
- lima 10y agoActually, the default Red Hat SELinux is exactly for preventing network vulnerabilities. Local users are unconfined. Example: your web application allows remote code execution. Even the default rules prevents most access (spawning a shell etc.) and generate lots of alerts.