[CentOS] SELinux - way of the future or good idea but !!!
Leonard den Ottolander
leonard at den.ottolander.nl
Tue Nov 30 06:45:58 EST 2010
On Mon, 2010-11-29 at 12:35 -0600, Les Mikesell wrote:
> If you don't trust your software, run it under a uid that doesn't have
> write access to anything important - or in a VM or a different machine
> for that matter. X has no problem displaying programs running with
> different uids or locations.
Using a "safe uid" will not stop a buffer overflow from happening and
causing a privilege escalation if such an issue exists in the software.
SELinux will negate most of the damage by disallowing even the escalated
process access to resources it shouldn't touch.
With the ever increasing complexity of software is there any software
you trust? I know I don't. Are you running your Flash plugin in Mozilla
as a different user than the one you logged into under X? Care to
elaborate how to accomplish such a feat? Or can you provide any
mount -t life -o ro /dev/dna /genetic/research
More information about the CentOS