3 ms·
> With SELinux root can build systems which are so secure that root himself cannot hack them. Sounds like your administrator would be well served to spend more
by zurn 14y ago
> With SELinux root can build systems which are so secure that root himself cannot hack them.
Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :)
See eg. http://grsecurity.net/~spender/exploits/exploit2.txt http://grsecurity.net/~spender/exploits/exploit2.txt
- meaty 14y agoThe exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly... So it technically would extinguish itself there and then. It works on the principle of least privilege so you start with nothing and add what the process needs.
- icelancer 14y agoNo True SELinuxman, I see