3 ms·
I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful
by stonogo 4y ago
I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful system-level protection from root accounts, to the degree that most deployments who bother at all only protect one or two directories. Even then SELinux is such a bolted-on mess that it's still subject to evil maid attacks and so forth.
And you're wrong about OpenBSD. I'm not going to get as angry about this as you appear to be, but I recommend you run "man 7 securelevel" on one of the OpenBSD systems you've been playing with for 20 years.
- Zurrrrr 4y agoYou're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to the benefit. I'm not remotely wrong about OpenBSD, and that manpage doesn't contain anything that contradicts a point I've made.
- stonogo 4y agoI administer thousands of selinux boxes professionally. I, like the vast majority of Earth's population, remain steadfastly uninterested in Fedora's default behavior. You claim that OpenBSD has no conpromised-root mitigation. I have provided evidence to back my counterclaim. I will assume your rejection of actual evidence indicates a disinterest in good-faith argument, so I won't bother pressing the point, except to mention that you may be more successful persuading people to support your case if you adopt a reality-based approach to argument instead of just making wild-ass assumptions about other people.
- Zurrrrr 4y agoYou haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.