News for hackers. Stuff that matters.

A comment on Domesticating applications, OpenBSD style. Parent comment

Re:Domesticating applications, OpenBSD style by chousuke on Wednesday July 22, 2015 @05:44AM (#9928572)
tame is easy and simple, which is a good thing, but comparing it to SELinux for ease of use is missing the point. SELinux is capable of providing very fine-grained access control depending on user, process and file contexts. tame is merely a syscall filter.

It's a good tool for dropping privileges from a process, but it doesn't even attempt to solve the same problem that SELinux does.

[ Parent | on HN ]
Re:Domesticating applications, OpenBSD style by batou on Wednesday July 22, 2015 @05:53AM (#9928608)
You're right but 99% of the problems I end up solving with SELinux are problems that fit tame perfectly. The rest of the problems are architectural i.e. the process doesn't have privilege separation mechanisms etc.
[ Parent | on HN ]