Linked by Thom Holwerda on Tue 26th May 2009 18:32 UTC, submitted by diegocg
Eric Paris, a SELinux developer, has announced today a new SELinux feature: "Dan and I (mostly Dan) have started to play with using SELinux to confine random untrusted binaries. The program is called 'sandbox.' The idea is to allow administrators to lock down tightly untrusted applications in a sandbox where they can not use the network and open/create any file that is not handed to the process. Can be used to protect a system while allowing it to run some untrusted binary."
Permalink for comment 365831
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Member since:
2006-07-26
I would think, this concept should just go to a mainstream. All binaries are untrusted. And all scripts are untrusted. If you have a worm, it can modify any script or binary and do something unexpected. So, if some component can do only explicitly described actions and nothing else, it would create a safe system by definition.