ACL

[kent at songbird.com]

On Mon, Jul 28, 2008 at 11:25:21AM -0400, Broekman, Maarten wrote:
> This is the point I was trying to make.  Sorry if that wasn't clear.  If
> there's no legal reason for the sysadmins to access the particular data,
> then there's no reason for them to object to having SELinux policies in
> place to enforce the written (or unwritten) policy.
> 
> SELinux in no way reduces the need to hire trustworthy people.  It
> probably increases the need to do so since you have to hire people you
> can trust to correctly implement the policies.

There's a confusion between "UID 0" and "ultimate sysadmin authority". 
Obviously, someone has to set up and manage SELinux boxes -- they don't
magically administer themselves. 

SELinux systems still need ultimate sysadmin authority -- it's just no longer
UID 0.  (As I understand it, ultimate sysadmin authority in SELinux requires
direct console access.) It's very similar to sudo, in that it allows a finer
grain control over who can do what. 

The value is that services that normally require root to do their work can be
sandboxed, so that if they get hacked, they can't get to other parts of the 
system.

Kent