Re:SELinux is unmanageable; just turn it off if it gets in y...
by loeg on Wednesday April 27, 2022 @10:16AM
(#31180152)
> When you ship a software product, enable SELinux or AppArmor and audit what it does: then ship an SELinux/AppArmor profiles.
It's not just sysamins -- developers don't understand SELinux, either.
As a dev, I find least-privilege sandboxing (e.g., look at how sshd is structured) and capabilities (e.g. FreeBSD capsicum) somewhat non-intuitive, but at least tractable to understand. SELinux is a blackhole.
It's not just sysamins -- developers don't understand SELinux, either.
As a dev, I find least-privilege sandboxing (e.g., look at how sshd is structured) and capabilities (e.g. FreeBSD capsicum) somewhat non-intuitive, but at least tractable to understand. SELinux is a blackhole.