How NSA access was built into Windows

[Tim]

On Tue, 2007-01-16 at 01:10 -0500, Claude Jones wrote:
> Maybe you guys are thinking about this all wrong. Suppose that Selinux
> is really a diversion. By forcing the question of mandatory access
> controls at the kernel level, there's a team of specialists being
> trained who are mastering in great depth, the detailed minutiae of how
> each daemon they program for, functions at the lowest levels. The goal
> is to create the specialist team that knows every hook, every detail,
> of low level operations of all major sofware running in the OS

I was being more of a devil's advocate than anything else...  But going
along with what you mention, is more in keeping with what I had in mind.

SELinux is about restricting access, not providing more of it.  If you
remove it, you're granting access to more of your system.  The real
question is whether SELinux has a loophole that grants access without
you knowing about it (lunatic wild conspiracy theory).  Unless SELinux
provides yet another way into your system, removing it doesn't bring
about any tangible security benefits.

It goes back to one of the original discussions, what *EXACTLY* does it
do (more than we know about?).  If it *only* adds restrictions, there's
nothing for anybody to worry about.  Except, perhaps, for some program
authors that think that they should be able to read any file on the
system without restrictions (e.g. your /etc/passwd files, and so on,
being served out through Apache).

-- 
(Currently testing FC5, but still running FC4, if that's important.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.