TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

What does SELinux do to contain the the bash exploit?

39 pointsby nsajeover 10 years ago

7 comments

616cover 10 years ago
I think a lot of people will disparage and mock Dan (FYI he is a core SELinux developer for Fedora if you do not know), but I think he outlines that it does prevent the medium risk stuff which I think no base Linux system (without MAC systems (SELinux, RBAC, AppArmor,etc.), just DAC of Unix file permissions) would let pass easily. All the logs, all the non-root data which hackers would use to build up to move forward in their operation.<p>I guess CGI scripting is convenient and necessarry for most of us (just like bash itself), and SELinux did not prevent Heartbleed either. But that does not mean I will make coloring jokes about its inefficacy.
评论 #8371878 未加载
评论 #8371847 未加载
评论 #8372604 未加载
willvarfarover 10 years ago
I&#x27;m a big fan of SELinux, and for many shellshock attacks it will limit exposure, but Dan should know better than invite people to ask him how SELinux helps mitigate a dchp shellshock attack...
mrmondoover 10 years ago
Big fan of SELinux here - it&#x27;s really saved my ass a few times and the best thing about it is that these days it&#x27;s so damn easy to configure that you&#x27;re mad not to use it.
devicenullover 10 years ago
<p><pre><code> Lets look at what it can read. ... It can read apache static content, like web page data. Well what can&#x27;t it read? user_home_t - This is where I keep my credit card data *db_t - No database data. </code></pre> So, it can&#x27;t read database data directly, but presumably your website can already connect to the database. Which means it can read out your database credentials, and just connect to the database?
treedover 10 years ago
There are lots of stories of SELinux saves out there now. This is one I saw just recently:<p><a href="https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved_our_asses_xpost_rselinux/" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;linux&#x2F;comments&#x2F;1xdokz&#x2F;selinux_saved...</a><p>I myself have had several SELinux saves. It&#x27;s definitely proven itself valuable as an additional security control.
qwertaover 10 years ago
It is like asking if it would catch SQL injections. Just sanitize your inputs !
yarrelover 10 years ago
&quot;SELinux does not block the exploit&quot;<p>Of course not. The exploit doesn&#x27;t come in coloring book form.
评论 #8371632 未加载