4 ms·
You're comparing two whole system approaches against an individual tool. If you look at the largest SELinux user, RHEL, you find that SELinux is just a single
by blocke 16y ago
You're comparing two whole system approaches against an individual tool.
If you look at the largest SELinux user, RHEL, you find that SELinux is just a single line of defense. The philosophy that "code will always have bugs" is in play and so in addition to SELinux RHEL has many other layers of protection.
Mark Cox has an excellent list of technologies that contains all the things that come into play even before SELinux has to make a policy decision:
http://www.awe.com/mark/blog/20101130.html http://www.awe.com/mark/blog/20101130.html
- tptacek 16y agoI agree, that is what I am doing. I'm using SELinux as a synecdoche for all the OS security strategies that rely on access control policies, and pointing out that they are being made fun of by exploits that simply turn them off. There clearly is a philosophical different between Theo de Raadt (new security features are window dressing, what matters is code quality), SELinux (the missing MAC feature is the problem with operating system security), and Scott Spengler (the problem is that the system has to be built to anticipate the specific things attackers will throw at it). This isn't some deep insight on my part; the parties involved are pretty vocal about it.