10 ms·
> The cure for "Enumerating Badness" is, of course, "Enumerating Goodness." Amazingly, there is virtually no support in operating systems for such software-lev
by dvfjsdhgfv 2y ago
> The cure for "Enumerating Badness" is, of course, "Enumerating Goodness." Amazingly, there is virtually no support in operating systems for such software-level controls.
Really? SELinux and AppArmor have existed since, I don't know, late nineties? The problem is not that these controls don't exist, it's just they make using your system much, much harder. You will probably spent some time "teaching" them first, then actually enable, and still fight with them every time you install something or make other changes in your system.
- ivlad 2y ago> You will probably spent some time "teaching" them first SELinux works well out of the box in RHEL and its derivatives since many years. You comment shows, you did not actually try it. > fight with them every time you install something or make other changes in your system If you install anything that does not take permissions into account, it will break. Try running nginx with nginx.conf permissions set to 000, you will not be surprised, it does not work.
- dvfjsdhgfv 2y agoI'm glad SELinux works better than in the past and at the same time I'm sorry it didn't from the start as many people were frustrated by it at that time (e.g. [0]). On the other hand, it looks like some people still get upset by it[1]. [0] https://news.ycombinator.com/item?id=13398582 https://news.ycombinator.com/item?id=13398582 [1] https://www.ctrl.blog/entry/selinux-unmanageable.html https://www.ctrl.blog/entry/selinux-unmanageable.html