News for hackers. Stuff that matters.
Re:Technical reasons to choose FreeBSD over GNU/Linux (2020) by matthews2 on Saturday August 06, 2022 @01:15PM (#32369836)
FreeBSD has the concept of a 'security level'. You can increase it at runtime, which disables more functionality, but you can't decrease it without a reboot.

At security level 1, the immutable and append only attributes on files can't be removed, so even chattr -i would be useless.

Re:Technical reasons to choose FreeBSD over GNU/Linux (2020) by znpy on Saturday August 06, 2022 @01:39PM (#32370029)
Linux has SELinux, which is enabled by default in RHEL and derivatives.

You could literally hand out root shell to people, and they wouldn’t be able to make much mess out of it.

There are SELinux policies to prevent disabling selinux too, of course.

You probably wouldn’t even need chattr.

Re:Technical reasons to choose FreeBSD over GNU/Linux (2020) by pxc on Saturday August 06, 2022 @02:12PM (#32370315)
SELinux is way more complex than security levels sounds here.
Re:Technical reasons to choose FreeBSD over GNU/Linux (2020) by GekkePrutser on Saturday August 06, 2022 @04:21PM (#32371249)
Securelevels are not just this. FreeBSD has its own SELinux equivalent called Mandatory Access Control:

https://docs.freebsd.org/en/books/handbook/mac/

It goes far beyond making files immutable. I haven't really done a deep dive to see if it's on par with SELinux but the description in this thread doesn't do it justice.

Re:Technical reasons to choose FreeBSD over GNU/Linux (2020) by pxc on Saturday August 06, 2022 @06:00PM (#32371958)
What I meant is that devising a sane and useful way to make use of security levels seems easier than achieving something 'equivalent' with SELinux. Sophisticated policy systems are nice, but something that kind of bundles sane defaults together and organizes them into ordered layers like security levels sounds great.