On Tue, Sep 1, 2015 at 2:24 PM, Josh Boyer <jwbo...@fedoraproject.org> wrote: > > Confining things through xattr labels on inodes. ;) FWIW, despite > warnings to the contrary, the test system I have does boot just fine > with SELinux in Enforcing mode. It is likely the least scientific and > useful scenario though, as it is just a dumb headless NUC box that all > I do is test kernels on. I won't even pretend that my mention here is > anything more than an anecdote along the lines of "cool story, bro."
It's too bad that there isn't a well-supported way to lock down /proc other than setting up inode labels and adding MAC policy. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
