Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4436

Re: Mandatory Access Control

Show all headers | View raw

SELinux is more elaborate and more complicated than Apparmor; tomoyo 
relatively new. I would personally regard none of those MAC systems as 
ultimate remedy to hard security problems. In 2011 I had a 
RedHat/SELinux system in its default configuration and it was 
compromised within minutes by simply viewing the page of my bank with a 
web browser (read the whole at: 
http://www.elstel.org/Censorship.html.en). Note that a single faulty 
system call in the Linux kernel may be used to obtain root rights 
leaving all additional security gains that MAC systems should deliver 
behind. Please note also that a system can not be secured without 
securing your X-server (formerly one could even paste text into any 
other window like a root console without being in need of root rights). 
Finally the security profiles of MAC systems are very complicated so 
that they would hardly deliver the security as possible in theory. If 
you wanna ask me for my security solution it is qemu based and puts the 
most vulnerable system components like browsers and email programs into 
a virtual machine namely qemu which is maintained by the Open Source 
commnunity.

Regards,
Elmar

On 29.11.2015 18:29, c4p0 wrote:
> I read the fucking manuals but don't have clear what is the better
> option of "Mandatory Access Control" for debian jessie.
> (AppArmor, SElinux, tomoyo, etc ..)
>
> someone can give me your opinion about it?
> thanks in advance
>
>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [SECURITY] [DSA 3405-1] smokeping security update Fredrik Kers <fredrik.kers@netrounds.com> - 2015-11-26 09:40 +0100
  Re: [SECURITY] [DSA 3405-1] smokeping security update Paul Wise <pabs@debian.org> - 2015-11-26 11:30 +0100
    Re: [SECURITY] [DSA 3405-1] smokeping security update Fredrik Kers <fredrik.kers@netrounds.com> - 2015-11-26 12:30 +0100
      Mandatory Access Control c4p0 <capo@riseup.net> - 2015-11-29 18:40 +0100
        Re: Mandatory Access Control Jason Fergus <leech@thefnords.org> - 2015-11-29 21:00 +0100
        Re: Mandatory Access Control Elmar Stellnberger <estellnb@gmail.com> - 2015-11-29 21:30 +0100
          Re: Mandatory Access Control Elmar Stellnberger <estellnb@gmail.com> - 2015-11-30 17:30 +0100
            Re: Mandatory Access Control Patrick Schleizer <adrelanos@riseup.net> - 2015-11-30 17:50 +0100
              Re: Mandatory Access Control Elmar Stellnberger <estellnb@gmail.com> - 2015-11-30 18:50 +0100
          Re: Mandatory Access Control Elmar Stellnberger <estellnb@gmail.com> - 2015-11-30 18:30 +0100
            Re: Mandatory Access Control Johannes Graumann <johannes.graumann@graumannschaft.org> - 2015-11-30 19:00 +0100

csiph-web