News for hackers. Stuff that matters.

A comment on Using tame() in userland. Parent comment

Re:Using tame() in userland by bkeroack on Friday August 28, 2015 @01:00PM (#10136588)
Presumably the program author (or OpenBSD ports maintainer) knows more about what permissions the program requires than the end-user sysadmin who would be configuring SELinux, AppArmor, etc.
[ Parent | on HN ]
Re:Using tame() in userland by caf on Friday August 28, 2015 @07:10PM (#10138286)
It depends, really. In terms of which system calls the program needs, that's certainly true.

However, in terms of things like "which files will this program need to access", the system administrator is in a much better position, because these kinds of questions often depend on how the program is used in a particular environment.

The approaches are complementary.

[ Parent | on HN ]