Like, AWS' IAM for the single server.
I recall some ten years ago DAC vs MAC was a frequently debated topic, nowadays seems nobody talks about it, not sure if because trustedbsd/selinux/apparmor didn't deliver on the promises or anything else.
Like, AWS' IAM for the single server.
I recall some ten years ago DAC vs MAC was a frequently debated topic, nowadays seems nobody talks about it, not sure if because trustedbsd/selinux/apparmor didn't deliver on the promises or anything else.
In fact that is why you even nowadays see "SELinux must be disabled" in application manuals. The early SELinux iterations really broke all the applications, and many people never took a second look at the technology. 9/10 of the application vendors that recommend disabling SELinux really don't do anything that would hit a targeted policy - the SELinux is already practically disabled for them. They just destroy the protection for the other software in the system...
Most common tweaking tasks can be found from booleans, and extra tweaks are easy to accomplish the help of audit2allow. However it baffles me to notice that audit2allow is not part of the default installations. It is a life saver that makes finding out why SELinux doesn't allow something really fast and easy.