| View previous topic :: View next topic |
| Author |
Message |
wswartzendruber
Veteran
Joined: 23 Mar 2004
Posts: 1261
Location: Idaho, USA
|
 Posted: Mon Jan 11, 2010 11:50 am Post subject: GRSecurity vs. SELinux |
 |
|
Can someone provide sound reason to installing SELinux on top of GRSecurity? It seems that the point of SELinux is to contain a bomb after it goes off. Why not prevent the explosion in the first place? This question, obviously, includes PAX.
_________________
Git has obsoleted SVN.
10mm Auto has obsoleted 45 ACP. |
|
| Back to top |
|
 |
ToeiRei
Veteran
Joined: 03 Jan 2005
Posts: 1191
Location: Austria
|
| Posted: Mon Jan 11, 2010 1:40 pm Post subject: |
|
|
isn't grsecurity part of SELinux?
_________________
Please stand by - The mailer daemon is busy burning your messages in hell... |
|
| Back to top |
|
|
prometheanfire
Developer
Joined: 21 Apr 2005
Posts: 87
Location: San Antonio, TX USA
|
|
| Back to top |
|
|
cach0rr0
Bodhisattva
Joined: 13 Nov 2008
Posts: 4123
Location: Houston, Republic of Texas
|
| Posted: Tue Jan 12, 2010 12:17 am Post subject: Re: GRSecurity vs. SELinux |
|
|
| wswartzendruber wrote: | | Can someone provide sound reason to installing SELinux on top of GRSecurity? It seems that the point of SELinux is to contain a bomb after it goes off. Why not prevent the explosion in the first place? This question, obviously, includes PAX. |
If you go the traditional "Gentoo Hardened" route, there is none.
as i understand it both grsec and selinux have a set of kernel patches, both have an RBAC mechanism.
http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml
(see the bit about selinux options in the kernel)
Bigger point is that grsec DOES have the ability to take care of a bomb after it's already gone off.
They attempt to do basically the same things, just, grsec seems to do it better IMHO.
-both projects offer a set of hardening patches for the kernel
-both projects offer an RBAC mechanism
You could use both selinux/grsec together, but it would be a pain.
And as everyone I've chatted to that has far greater knowledge on the topic than myself...people I trust...have said grsec is the superior solution, I've opted for that. Couple that with some of the demonstrations I've seen from 'spender' showing selinux actually making things WORSE, for me it's a no brainer.
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash |
|
| Back to top |
|
|
|
Networking & Security
