<p>True enough. An over symplification indeed. Blank out securetty to disallow direct root login outside of runlevel 1.</p>
<p>Some stuff must be run as root. But selinux policies can allow communication without it if carefully crafted and using <500 UID for process user.</p>
<p><blockquote type="cite">On Jul 31, 2010 12:59 PM, "Scott McBrien" <<a href="mailto:smcbrien@gmail.com">smcbrien@gmail.com</a>> wrote:<br><br><div bgcolor="#FFFFFF"><div>That's all well and good if you want to make your own policy, but on RHEL, CentOS, and Fedora, root runs as an unconfined user, so for the most part they can still mangle whatever they want. "Learn SELinux" is simplifying A LOT.</div>
<div><br></div><div><font color="#888888">-Scott</font><p><font color="#500050"><br><br>On Jul 31, 2010, at 12:29 PM, Jim Kinney <<a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>> wrote:<br></font></p>
</div><p><font color="#500050">> Learn selinux.<br>>><br>>> On Jul 31, 2010 12:14 AM, "Michael Trausch" <<a href="mailto:mike@trausch.us">mike@trausch.us</a>> wrote:<br>>><br>>> Th...</font></p>
</div><br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></p>