vote
 |
|
SELinux for mortals?
The orginal SELinux approach was that anything not expressly permitted was forbidden. Technically, this meant that every program anybody would ever run had to be configured with a policy that indicated what files it could touch, who could run it, and every other aspect of the program that might present a risk. Practically, this meant that you'd start your system and find that some obscure daemon wasn't running--and the only diagnostic aid you had was a few lines listing process IDs and inodes.
| | |
| |
|
|
