Re: Bug (?) in cvs selinux policy

[Antoine Martin <antoine@nagafix.co.uk>]

On Wed, 2005-11-30 at 00:11 +0100, Erich Schubert wrote:
> Hello,
> > I think this allows it to cp the locale file into the chroot environment.
> 
> For example with postfix, running stuff in a chroot is "deprecated" with
> SELinux, since the security implicatons of setting up the chroot are
> higher than not running a chroot but only SELinux. ;-)
I personally like to have the option of using both, for peace of mind.
I am not good enough to run my systems in full enforcing mode constantly
(there are still some maintenance tasks that I do which are much easier
to handle by switching to permissive mode) and so I like to have the
ability to cumulate the security measures.

Antoine

> Also, the setup should probably done by the init script, not by the
> daemon.
> 
> best regards,
> Erich Schubert


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.