| |||||||||||||
Handle it with the package manager?Handle it with the package manager?Posted Apr 13, 2012 14:22 UTC (Fri) by NRArnot (subscriber, #3033)Parent article: SELinuxDenyPtrace and security by default
Scientific Linux has several "tweak" packages that alter the behaviour of a system. For example there's one (from memory sl-nocolorls) that turns off the default colorization of ls output.
Wouldn't it be a good idea to have an package "Selinux-allow-ptrace" and bundle it as one of the default packages in the "software developer" group? Also create dependencies so that it is installed if you later install a debugger that won't work until ptrace is allowed?
this way users would not have to be fully clued up. An installation without software development tools would be maximally secure. Installing a debugger would change the default, because the maximally secure default is also maximally useless given that choice.
(Log in to post comments)
Handle it with the package manager? Posted Apr 13, 2012 16:54 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link]
You don't need a whole new package. Post scripts in any RPM package can turn off SELinux booleans if necessary. However this means that developer systems are not secured. What would be ideal is just gdb or specific tools like that having that access but only if it is initiated by the user and not programs themselves unless they are specifically allowed that access.
|
|||||||||||||