4 ms·
We could go a bit further with MAC (Mandatory Access Control). Something like SELinux. Properly understood, SELinux can provide rock-solid security. Of course,
by ivanmontillam 5y ago
We could go a bit further with MAC (Mandatory Access Control). Something like SELinux.
Properly understood, SELinux can provide rock-solid security. Of course, it's not a replacement of other security software, but it can prevent most of sneaky leakages such as the we had just seen in this post.
MacOS doesn't ship with SELinux, but I believe it has something similar.
- jodrellblank 5y agoCan it? (Genuine question). I understand SELinux can block processes from opening network sockets for example, but aren't drivers modules loaded into the kernel and not their own process, so you'd have to block the kernel from doing things or not? Or can SELinux go more granular than that?
- wtallis 5y agoWhen a proprietary/vendor-supplied out of tree driver includes analytics/telemetry/spyware, it's most likely going to be in a userspace component. Such drivers will almost always include at least a userspace configuration tool and often a userspace daemon.
- jeroenhd 5y agoI don't know if it's SELinux or the containerisation API, but such a mechanism is also in play with sandboxed Linux applications (Flatpak, Snap). On Ubuntu there are many apps you can disable a lot of permissions for because of the snappification of the OS.