Discuss mailing list

[Tully Gray <tullygray AT arc.net.au>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Brian Koontz wrote:
>
> To be truthful, the first thing I do is disable selinux...because it
> seems like a never-ending battle to create the acls necessary that
> every application seems to need. I do run *all* my outward-facing
> services under chroot.
>
> --Brian
>

Hi,

I don't use SELinux but rather the RBAC rules from GRsecurity.
However I tend to agree with your assessment; RBAC rules can be
tedious to maintain too.  I guess that if OpenNIC were a large security
focused company then it would be possible to employ people whose
job it was to maintain such rules.  SELinux and GRsecurity based
Linux systems can be configured in a manner that doesn't make full
use of all their features, which makes the job somewhat easier.

Tully Gray.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)

iQIcBAEBAgAGBQJPp5mSAAoJEKNjRVNXXwT+ZbgP/1+fDO0lps2hFt3Y6BfkOfOM
QXEyD7u2RsCUuZzi4KFjxXy/JOJorH5Ui7S/nLfo99HNgVciBI/dCRTOV0XOJzoc
sRwdjisbIHCHKA1/GPtuN8RzQ2vhPzZ+DjajLolUUWWXPSz7kDcMEoQxfvGNK41M
HT5izVB6/lFpYNVDrcEe/5qCUAnjuu0PG6TzqJfHMFPLKVPsMIU5h4+9vqOK6MRv
3mpK3BeHlfhLj5ooUPRf+Y/a3D2N5xAG76CI6wdhGt/RIUgu6VXVzjPODCLh9w6f
PVQA3A1HF4Od4pT2U1WsloArLBdWYSVYpnCOEeAcQTo2MGJmOeV0LJDmTIR/n8GB
bmCdNxE4zIJxmIzF5Kc7sSFGA/+tnelCxeDFIcbkd8sk167QdHfzYDpzd6kbS0bR
fetJ+SrcttBs3e+R29xnEucukJozM+FGJPDZhWcBeS3bCLXaWkTYsOdD6hEezJFg
LtKgj1+tWBgdxgWrVIQadmjoS6Z4Rk9Iu3ISpxZdymviBJjOnSN+Z9ySH7dnqvSF
cN/xJzSx3ed/GJh2YUmEEkaEsRjH3n+ske2pwHNyL57mrkxKNJFEkwYkegasyQ0g
kn/W4pC0tIALEDgZFxPm+uScPPz2PWM0oDaxl/aljQsppHdOVAFOkHV+muDqwHmz
guunFTbqFhEayzb4UntR
=Yk6z
-----END PGP SIGNATURE-----