4 ms·
> SELinux means you are getting the people who value security Proper, very strict sandboxes implemented with seccomp & friends are much more secure. You simply
by eeZah7Ux 9y ago
> SELinux means you are getting the people who value security
Proper, very strict sandboxes implemented with seccomp & friends are much more secure. You simply block the large majority of system calls.
Surprisingly, they are often easier to set up.
- noja 9y agoCan you recommend any distros that use it extensively, or is it too early?
- eeZah7Ux 9y agoIdeally upstreams, rather than distributions, should sandbox their own projects. However, Debian is shipping a number of hardened systemd unit files. To see some examples on how the sandboxing is being set up you can grep for SystemCallFilter, CapabilityBoundingSet, ProtectSystem, ProtectHome in /lib/systemd/system/*.service
- deleted 9y ago[deleted]