Docker 0-Day Stopped Cold by SELinux

Re:Docker 0-Day Stopped Cold by SELinux by w8rbt on Saturday January 14, 2017 @09:53AM (#13398607)

That's the issue with LSMs in general. They all work, but historically have been difficult to configure and impossible to maintain. That's changing.

There used to be only one (SELinux), however, there's competition now from other LSMs. Smack, AppArmor, Tomoyo, etc. In part, that's why SELinux is improving.

I've tried them all and settled on Tomoyo. The documentation is outstanding and it is (to me at least) the easiest LSM to reason about and configure.

http://tomoyo.osdn.jp/

[ Parent | on HN ]

Re:Docker 0-Day Stopped Cold by SELinux by jwildeboer on Saturday January 14, 2017 @10:02AM (#13398653)

How up2date is tomoyo, though? The Changelog and updates on the front page seem to indicate that not much happened after 2015.

[ Parent | on HN ]

Re:Docker 0-Day Stopped Cold by SELinux by w8rbt on Saturday January 14, 2017 @10:11AM (#13398690)

Last git commits in the Linux kernel were in 2016:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....

[ Parent | on HN ]

Re:Docker 0-Day Stopped Cold by SELinux by djsumdog on Saturday January 14, 2017 @02:42PM (#13400160)

I've had to create apparmour profiles in the past. There is some good tooling, but it's still not trivial.

[ Parent | on HN ]