Posted Nov 26, 2004 4:17 UTC (Fri) by Method
In reply to: Civilizing SELinux
Parent article: Civilizing SELinux
Congratulations on the context destruction there. The context of the above quote was "The end result is that, even if named falls to a remote code exploit, there is very little that exploit can actually do."
So, a code exploit [in named] would be contained.
You speak as if some other access control system solves kernel exploits and we all know that isn't true, don't we ;)
And on the topic of policies.. I'm sure you believe learning mode produces better policies but that isn't true. Learning mode only tells what an application *tries* to do, not what it *should* do. If you knew anything about SELinux or had ever looked at the current policies you'd see the many cases where a policy writer feels an application is overstepping it's bounds and notes that it runs without the requested access and he puts a 'dontaudit' in the policy to squelch the denial while still preventing the access.
to post comments)