[–] 1 point 5 days ago

In some usecases SELinux is less flexible:

You have two applications installed which bring their own labels and rules, lets say app_a_t and app_b_t. Now you want to give AppA read access to only one specific directory of AppB data (which is labeled app_b_t).

How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for app_b_t.

My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).

  • source
  • parent
  • context
  • [–] 9 points 2 weeks ago (1 child)

    I don't think so about the post-facto decrypt. Keyexchange runs with the certs of the destination server. The cerst affected by the leak are intermediate certs which give trust to a cert chain AFAIK.

  • source
  • parent
  • context
  • [–] 1 point 3 weeks ago

    It’s quite aggrivating that the first half of the list space is wasted on irrelevant junk (random, pets, etc).

    There was a recent update of Mbin, so I checked this and it seems to be fixed. Your crosspost should be possible now.

  • source
  • [–] 6 points 1 month ago (2 children)

    But some things are directories (like cgroups). And Networknamespaces were also controled in a weird way.
    And then there are kernel features which are not exposed through a file or syscall but through a special type of socket.

  • source
  • view more: next ›