3 ms·

Does anyone have any examples of where SELinux saved the day? I appreciate that some of the time you'd never know, but I am curious if anyone has any real life

• bravetraveler 4y ago
  For me, nothing too solid but it makes me sleep better. Not so much an attacker but bad actor(s)... It has saved us from having people with expected (limited) access to systems from spawning services listening on the network that shouldn't be there Granted, we have a default drop policy in the firewall, so it shouldn't really matter in a sense. I like the approach of not having the process rather than preventing access to it The attacks could be worse. For example, some users SSH access was compromised and the attacker wants to use it -- opening a reverse tunnel on localhost out of the environment over their SSH connection... bypassing the usual perimeter for egress. SELinux should provide some nice control over this that would be independent of service
• microtonal 4y ago
  https://www.redhat.com/en/blog/selinux-mitigates-container-vulnerability https://www.redhat.com/en/blog/selinux-mitigates-container-v... https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/ https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-s... https://danwalsh.livejournal.com/30565.html https://danwalsh.livejournal.com/30565.html