4 ms·
They do put some effort into internal controls, e.g. SELinux came from the NSA originally. But apparently not enough!
by mjn 13y ago
They do put some effort into internal controls, e.g. SELinux came from the NSA originally. But apparently not enough!
- eli 13y agoSomeone has to be able to sudo on the box and administer the internal controls. It's pretty hard to audit that person.
- rwmj 13y agoWrong. Read about audit tools in RHEL. They are entirely designed to cope with this scenario.
- Amadou 13y agoSince "root" in an SELinux configuration has just that one job, it is significantly easier to limit access to that privilege level to very specific cases which you can two-man or externally record ala the script command. Assuming, that is, the system was set up that way in the first place. Which is such a PITA that I totally believe they just skipped it.
- stephengillie 13y agoThat makes root sound like a gaping security hole. Almost all Windows installations disable the Administrator account and hand out permissions only where necessary.