Re:SELinux is unmanageable; just turn it off if it gets in y...
by ethbr0 on Wednesday April 27, 2022 @05:46PM
(#31186220)
You're missing my point.
It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux problem)
The very concept of having a container (that internally simulates a system) creates fundamentally different opportunities that allow both (programs that work) and (security).
Whinging about whether or not current containers do a good or bad job of it is a less interesting, short term quibble.
It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux problem)
The very concept of having a container (that internally simulates a system) creates fundamentally different opportunities that allow both (programs that work) and (security).
Whinging about whether or not current containers do a good or bad job of it is a less interesting, short term quibble.