Viewing profile — treasy

SELinux is overly complicated, but it’s not hard to at least grasp the basics The amount of people confusing DAC and MAC is concerning. You’ve done an excellent job explaining the …

Those files would be editable by something in the sysadm_t domain which is by default the domain of the root user after a successful authentication This backdoor does not bypass re…

Selinux domains are uncoupled from Linux users. If sshd does not have Selinux permissions to edit those files it will simply be denied. Even if sshd is run as root

libselinux is the userspace tooling for selinux, it is irrelevant to this specific discussion as the backdoor does not target selinux in any way, and sshd does not have the capabil…

If you look at the diagram of privsep, the authentication process is part of the privileged binary, which is where this RCE lives http://www.citi.umich.edu/u/provos/ssh/priv.jpg

You can definitely prevent a lot of file/executable accesses via SELinux by running sshd in the default sshd_t or even customizing your own sshd domain and preventing sshd from bei…