you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 days ago

In some usecases SELinux is less flexible:

You have two applications installed which bring their own labels and rules, lets say app_a_t and app_b_t. Now you want to give AppA read access to only one specific directory of AppB data (which is labeled app_b_t).

How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for app_b_t.

My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).

  • source
  • parent