5 ms·
It seems like you've been putting a lot of effort in, but posix uid/gid isolation is increasingly pourous with the typical desktop environment these days. It so
by trotsky 13y ago
It seems like you've been putting a lot of effort in, but posix uid/gid isolation is increasingly pourous with the typical desktop environment these days. It sounds like you are ready for real RBAC - if you put the time in selinux (or apparmor or grsec) is leaps and bounds more effective.
- sliverstorm 13y agouid/gid is generally a sound system, the problem IMO is basically that no one uses it for serious security, so a lot of things are not set up to be properly careful by default.
- XorNot 13y agouid/gid on Linux also is terrible for trying to enforce inheritance. POSIX ACLs help, but they're strikingly poorly documented/supported.