3 ms·

SELinux isn't about immutability, it's about program confinement. Running each daemon in its own fs/user/net namespace comes a lot closer to mimicking the value

• Zurrrrr 4y ago
  > SELinux isn't about immutability, it's about program confinement. The mechanisms that allow for program confinement also allow you to construct an immutable OS. > Running each daemon in its own fs/user/net namespace comes a lot closer to mimicking the value of SELinux than making the OS immutable. Maybe, but it's still pretty far off. SELinux is about removing DAC/an all powerful user much more than it is about sandboxing.