Can SELinux substitute DAC?
by Sven Vermeulen, post on Sun 09 August 2015A nice twitter discussion with Erling Hellenäs caught my full attention later when I was heading home: Can SELinux substitute DAC? I know it can't and doesn't in the current implementation, but why not and what would be needed?
SELinux is implemented through the Linux Security Modules framework which allows for different security systems to be implemented and integrated in the Linux kernel. Through LSM, various security-sensitive operations can be secured further through additional access checks. This criteria was made to have LSM be as minimally invasive as possible.
Some changes under the hood
by Sven Vermeulen, post on Sat 09 August 2014In between conferences, technical writing jobs and traveling, we did a few changes under the hood for SELinux in Gentoo.
First of all, new policies are bumped and also stabilized (2.20130411-r3 is now stable, 2.20130411-r5 is \~arch). These have a few updates (mergers from upstream), and r5 also …