4 ms·
It's interesting to see how it works with SELinux. The Fedora distribution upgrades to a new kernel version often, so after a few months you start seeing lines
by cesarb 9y ago
It's interesting to see how it works with SELinux. The Fedora distribution upgrades to a new kernel version often, so after a few months you start seeing lines like these in the kernel log:
[ 14.586798] SELinux: Permission getrlimit in class process not defined in policy.
[...]
[ 14.586887] SELinux: Class infiniband_pkey not defined in policy.
[ 14.586888] SELinux: Class infiniband_endport not defined in policy.
[ 14.586888] SELinux: the above unknown classes and permissions will be allowed
That is, the kernel part of SELinux supports more checks, but since the policy is old and doesn't know about them, they are allowed by default.
- ChrisSD 9y agoThat's not good from a security point of view but I guess it does avoid breakages.
- bluGill 9y agoNo, it is neutral from a security point of view: previously you couldn't configure the new thing at all, now you upgrade to where you can configure it, but isn't you didn't configure it the last time you configured everything (because you couldn't) so it default to as if you had enabled it. When you come back latter and think about this again you enable the new configuration with the right whitelist, but until then things work just as well as before.
- coldtea 9y ago>That's not good from a security point It is. You get the security you explicitly ask for, no more, no less. If you want more, you get to know what new is there, and enable it.