Hacker News Reader

It is also the reason why most common advice is to just turn off SELinux. It blocks valid (although sometimes weird) usage, because someone else decided that 90% of users should not do something.

Developer knows better what program should and should not do and is much more capable to set this kind of rules with pledge.

View on HN

Lets not forget that SELinux came out of the defensive side of NSA. Its to block attacks to government systems from both outside and inside. In essence it is the concept of "trusted computing" given form.

And that concept in turn means that a general can put a trusted system into hostile territory and trust it to not leak secrets.

And NSA still care for it. Around the time of the last kdbus dustup, someone from NSA voice a worry about how kdbus would compromise certain parts of SELinux.

Reply on news.ycombinator.com