2 ms·
SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by defa
by pilom 14y ago
SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by default now is indeed a band-aid. However, when developers and system admins understand how to create correct and secure SElinux policies, it does indeed approach bulletproof.
With SELinux root can build systems which are so secure that root himself cannot hack them.
- zurn 14y ago> With SELinux root can build systems which are so secure that root himself cannot hack them. Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :) See eg. http://grsecurity.net/~spender/exploits/exploit2.txt http://grsecurity.net/~spender/exploits/exploit2.txt
- meaty 14y agoThe exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly... So it technically would extinguish itself there and then. It works on the principle of least privilege so you start with nothing and add what the process needs.
- icelancer 14y agoNo True SELinuxman, I see