<html><body bgcolor="#FFFFFF"><div>That's all well and good if you want to make your own policy, but on RHEL, CentOS, and Fedora, root runs as an unconfined user, so for the most part they can still mangle whatever they want. "Learn SELinux" is simplifying A LOT.</div><div><br></div><div>-Scott<br><br>On Jul 31, 2010, at 12:29 PM, Jim Kinney <<a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><p>Learn selinux.</p>
<p></p><blockquote type="cite">On Jul 31, 2010 12:14 AM, "Michael Trausch" <<a href="mailto:mike@trausch.us"><a href="mailto:mike@trausch.us">mike@trausch.us</a></a>> wrote:<br><br><p>The big thing, yes, is that running everything as root defeats the whole sandboxing that you get by running as a normal user---or even running things as multiple, different users.</p>
<p>With the complexity of today's software (necessarily or not) being what it is, I can't say that I would run much of anything as the root user. For that matter, I don't, even on the command line. The only root privilege I retain for myself is the use of sudo, which I nearly always call as "sudo -u $NEEDED_USER $CMD". That way, if I screw something up, I have a command to show for it in the system logs.</p>
<p>I would personally like to see "POSIX" capabilities in wider use then they are. I think it is great to have such a versatile kernel-enforced privilege mechanism, and useful to take away all the special powers of UID 0. Although I don't think that it is at all as fine-grained as it could be without add-ons, and all of the add-ons that I know of pretty much suck.</p>
<p>Anyway, just my 2 cents. The more permissions are isolated and enforced by a kernel (which can often use hardware to provide the enforcement), the better contained things such as breakins or simply rogue users are. Not saying that would be a nirvana, but it would be a big help, I think. Especially when you do things like put syslog on the network without any permission but INSERT. Of course now I am talking about something way more complex than I wager most of us want to do at home...</p>
<p>--<font color="#888888"><br>
Sent from my HTC Dream---Running Froyo!<br>
Thanks, @cyanogen!</font></p><p><font color="#500050"><br>><br>> On Jul 30, 2010 7:59 PM, "scott mcbrien" <<a href="mailto:smcbrien@gmail.com"><a href="mailto:smcbrien@gmail.com">smcbrien@gmail.com</a></a>> wrote:<br>> One of the big problems ...</font></p>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org"><a href="mailto:Ale@ale.org">Ale@ale.org</a></a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank"><a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a></a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank"><a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a></a><br>
<br></blockquote><p></p>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Ale mailing list</span><br><span><a href="mailto:Ale@ale.org">Ale@ale.org</a></span><br><span><a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a></span><br><span>See JOBS, ANNOUNCE and SCHOOLS lists at</span><br><span><a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a></span><br></div></blockquote></body></html>