News for hackers. Stuff that matters.

A comment on SELinux is unmanageable; just turn it off if it gets in your way. Parent comment

Re:SELinux is unmanageable; just turn it off if it gets in y... by fefe23 on Wednesday April 27, 2022 @08:12AM (#31178926)
That's why I explicitly mention "whitelisting".

If you just want to ban some obscure syscalls and call it a day, you can do that. It will probably even be helpful to some degree.

I personally think our aspirations should be higher than "let's ban ptrace(2)".

[ Parent | on HN ]
Re:SELinux is unmanageable; just turn it off if it gets in y... by mmis1000 on Wednesday April 27, 2022 @10:37AM (#31180426)
It's actually a bit more than that. The syscall docker allowed isn't really fixed. It is affected by what linux capabilities the container had granted. Like: if you whitelist the container about CAP_SYS_PTRACE, you probably also want ptrace(2) to be whitelisted. Instead of a all or nothing/your program will still break even cap added model.
[ Parent | on HN ]