3 ms·
Rules might be a pain, but no more so than writing good firewall rules, and once done don't have to be done again. It's not the issue some make it out to be
by Zurrrrr 4y ago
Rules might be a pain, but no more so than writing good firewall rules, and once done don't have to be done again.
It's not the issue some make it out to be
- commandersaki 4y ago> and once done don't have to be done again Hardly, you'll have to update the rules when the program gets updated to do new things; whereas with pledge(2)/unveil(2) the developer simply applies more restrictions if needed before the program is distributed. pledge(2)/unveil(2) is not only superior because it cannot be disabled, it has better aesthetics than any of that apparmor/selinux garbage.
- Zurrrrr 4y agoOn most servers, programs are not doing drastically new things. That really isn't the issue you make it out to be. The developer applying restrictions ahead of time can't, by nature, mitigate the types of bugs that things like SELinux can protect against. You really have no clue about what you're talking about.