On Tue, December 30, 2014 3:45 pm, James B. Byrne wrote:
>
> On Tue, December 30, 2014 03:18, Digimer wrote:
>> What possible reason could they have for that?
>>
>> On 30/12/14 02:17 AM, Laurent Dumont wrote:
>>> By any change, is it a VPS? I know that my CloudAtCost (very cheap but
>>> extremely unreliable provider) prevents you from using SeLinux on their
>>> Centos image.
>
> No mysterious breakages == lower support costs. The same reason MicroSoft
> shipped everything on and open for years and thereby built up the malware
> industry from scratch.
I have that vague feeling that what I'm about to say will probably be
declared wrong... Still. From the very beginning I do not consider SELinux
adding to the security of the system. How can it if it can be turned off
on the fly? On the other hand, it adds hundreds of thousands of lines to
kernel code which does exactly opposite: deteriorates security by
potentially introducing bugs. I discovered at some point that there are
other people out there who share this opinion ;-)
So, my question is: can someone design attack scenario which would be
successful if it were not for SELinux, and which is thwarted by SELinux.
Note that the fact that script kiddie just forgot to put as a first line
/usr/sbin/setenforce 0
doesn't make such example a solid case pro SELinux for me.
Thanks a lot for your insight! (Always hoping to learn ;-)
Valeri
++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
