3 ms·
SELinux, and all of the other bolt on security model extensions, all have a parallel system problem. Fundamentally it's about adding a security definition laye
by mjevans 5y ago
SELinux, and all of the other bolt on security model extensions, all have a parallel system problem. Fundamentally it's about adding a security definition layer that just doesn't exist in the traditional UNIX privileges model; and it isn't even the typical extension of ACLs on objects. Instead it's a whole new set of tools or patch extensions to existing tools (which may as well therefore also be custom tools) that is completely opaque and therefore impossible for anything to interact with or provide good error messages for when it does inhibit interactions.
What I really dislike about SELinux and similar tools is the pivot in management. Inevitably since they're bolt-ons they also add a second policy area, no longer on the file or device but instead in some other database of inscrutable configuration files. A second and totally alien location to check when anything isn't working.
- PaulHoule 5y agoSince security properties are a global aspect of a system there is something to say for having them sit separate from the rest of the system. On the other hand that means every change (potentially) has to be made twice. It's good if you want to have a committee check every change but it slows changes down accordingly. Contrast that to https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security where the reference to an object and the access to the object are tied together. On paper it's a great model but it hasn't seen a lot of real life use.