On 05/25/2010 08:09 PM, Whit Blauvelt wrote: > > So with selinux, in general any script that selinux would stop from running > due to the script's own extra selinux file tags can be run if Evil Intruder > simply invokes the same script with its shell first - sh or perl or python > or whatever? That counts as security? Through what? The obscurity of this > devious workaround? Similarly, suppose I have a script (/usr/local/bin/example) with permission 0700. Now, if Evil Intruder simply copies the script elsewhere and changes its permissions, he can read and execute the script! Similarly, if I have Firefox running as userA, then userB cannot read its memory. However, if userB runs Firefox, he can read that process' memory! You're being silly. SELinux confines the daemons that the administrator starts so that they don't take actions that aren't allowed by policy. If an attacker gains access to the system with a higher set of privileges than the confined daemon, OF COURSE he can run the daemon with higher privileges. That doesn't negate the value of YOUR ability to DECREASE the privileges available to the daemons that run on your systems.