News for hackers. Stuff that matters.

A comment on DOGE Worker’s Code Supports NLRB Whistleblower. Parent comment

Re:DOGE Worker’s Code Supports NLRB Whistleblower by II2II on Wednesday April 23, 2025 @06:41PM (#43777416)
That is a very serious design flaw, but I also believe it is a flaw that is addressed by SELinux. (Perhaps someone with a knowledge of SELinux can offer some input here.) That said, I'm not sure how widespread the use of SELinux is and doubt that it would help in this case since the people in question have or can gain physical access.
[ Parent | on HN ]
Re:DOGE Worker’s Code Supports NLRB Whistleblower by jmainguy on Wednesday April 23, 2025 @06:57PM (#43777559)
If your root, you can just turn off selinux
[ Parent | on HN ]
Re:DOGE Worker’s Code Supports NLRB Whistleblower by fipar on Wednesday April 23, 2025 @10:16PM (#43778690)
Not without a reboot though, and while I haven’t done that, it should be possible to protect selinux ‘s config itself with a policy, requiring boot loader access to bypass, at which point you’re dealing with a different risk level.

I’ll agree that Linux security is quite limited and primitive if compared with, say, a mainframe, but it can be made less bad with a reasonable amount of effort.

[ Parent | on HN ]
Re:DOGE Worker’s Code Supports NLRB Whistleblower by saagarjha on Wednesday April 23, 2025 @10:40PM (#43778804)
What would the mainframe be running that avoids this problem?
[ Parent | on HN ]
Re:DOGE Worker’s Code Supports NLRB Whistleblower by fipar on Thursday April 24, 2025 @07:25AM (#43781389)
That’s a big rabbit hole, reading about RACF is a good place to start.

The short answer would be that mainframes come with RBAC from design, unlike Unix, which has a different security model from conception and then had rbac added on top of it in some cases (such as selinux).

[ Parent | on HN ]