3 ms·
SELinux is pain to maintain in more or less complex system. I more like approach taken by OpenBSD [1] but it requires code changes. [1] https://man.openbsd.org
by citrin_ru 2y ago
SELinux is pain to maintain in more or less complex system. I more like approach taken by OpenBSD [1] but it requires code changes.
[1] https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2
- mrweasel 2y agoPledge and Unveil makes a ton of sense, because it moves the responsibility to the developer who should know the application better than the systems administrator. Sometimes, when the developers make a mistake, which is unavoidable in a large project, it is nice to be able lock down applications as the administrator.I just don't think SELinux is the right tool, because the chance of you making a mistake in the configuration is pretty high. The functionality is there, but it needs to be easier to write policies and maybe that comes at the cost of some flexibility.
- nequo 2y ago> the developer who should know the application better than the systems administrator On the other hand, the administrator knows their system better than the developer. There could be certain network connections or file paths that you want to block on one system but not on another.
- ruthmarx 2y agoThe OpenBSD approach isn't even in the same league. Not only it is developer opt-in, but it is also limited to enforcing or restricting syscalls, that's it. If you have a root RCE in say sshd, pledge won't help you. SELinux will.