<p>Learn selinux.</p>
<p><blockquote type="cite">On Jul 31, 2010 12:14 AM, "Michael Trausch" <<a href="mailto:mike@trausch.us">mike@trausch.us</a>> wrote:<br><br><p>The big thing, yes, is that running everything as root defeats the whole sandboxing that you get by running as a normal user---or even running things as multiple, different users.</p>
<p>With the complexity of today's software (necessarily or not) being what it is, I can't say that I would run much of anything as the root user. For that matter, I don't, even on the command line. The only root privilege I retain for myself is the use of sudo, which I nearly always call as "sudo -u $NEEDED_USER $CMD". That way, if I screw something up, I have a command to show for it in the system logs.</p>
<p>I would personally like to see "POSIX" capabilities in wider use then they are. I think it is great to have such a versatile kernel-enforced privilege mechanism, and useful to take away all the special powers of UID 0. Although I don't think that it is at all as fine-grained as it could be without add-ons, and all of the add-ons that I know of pretty much suck.</p>
<p>Anyway, just my 2 cents. The more permissions are isolated and enforced by a kernel (which can often use hardware to provide the enforcement), the better contained things such as breakins or simply rogue users are. Not saying that would be a nirvana, but it would be a big help, I think. Especially when you do things like put syslog on the network without any permission but INSERT. Of course now I am talking about something way more complex than I wager most of us want to do at home...</p>
<p>--<font color="#888888"><br>
Sent from my HTC Dream---Running Froyo!<br>
Thanks, @cyanogen!</font></p><p><font color="#500050"><br>><br>> On Jul 30, 2010 7:59 PM, "scott mcbrien" <<a href="mailto:smcbrien@gmail.com">smcbrien@gmail.com</a>> wrote:<br>> One of the big problems ...</font></p>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></p>