| |||||||||||||
Inside SELinux on Fedora Core 3Inside SELinux on Fedora Core 3Posted Oct 8, 2004 1:08 UTC (Fri) by mongre26 (guest, #4224)Parent article: Inside SELinux on Fedora Core 3
Multiplication of the complexity is only applicable if you assume a worst case scenario.
While it may be complex to implement SELinux to apply to every single daemon on a multi-user system with dozens of daemons that interact with users, the issue is a lot simpler on say a web server.
A web server may run 3 or 4 main daemons with external access.
sshd for management
Other than that daemons either do not need to be run at all (xinetd), are local only (crond), or are part of the kernel daemons (kswapd).
For a system like this, which you want to be secure as possible from external threats, you have something like SELinux prevent externally listening daemons from being used to gain unauthorized access.
The approach of profiling only a few daemons is more valuable that it might first appear. That some people might argue against SELinux because of complexity it seems they may be setting SELinux up by selecting the worse case scenario. A scenario that is unlikely in a lot of application spaces.
The selected list of daemons is a good one, and reflects a good start.
Also once a profile is done, a lot of the hard work is complete. Then you can distribute the profile widely. The model scales well, it is just it needed a bit of a kick to get going. This is definitely a good start.
Not that management tools do not need improvement. Once you do get a lot of profiles you really need a system to effectively manage and modify them.
(Log in to post comments)
|
|||||||||||||