Hacker News new | past | comments | ask | show | jobs | submit login

Practically there's been many examples where SELinux restricted a security vulnerability. I think SELinux is way too complicated. Needing to know exact commands to turn error messages into something understandable is bizarre.

That said, SELinux determines what is allowed. Having it introduce an additional vulnerability/permission just due to configuration is really odd.

I tried searching for your example, but can only find security bugs, not configuration issues.




Turns out I was thinking PAX/Grsecurity back in 2005. Same principle, though: more knobs to turn = more knobs to turn wrong.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: