Lets look at what it can read.
... It can read apache static content, like web page data.
Well what can't it read?
user_home_t - This is where I keep my credit card data
*db_t - No database data.
What does SELinux do to contain the the bash exploit?
11–13 of 13 posts
Re: What does SELinux do to contain the the bash exploit?
#12I think a lot of people will disparage and mock Dan (FYI he is a core SELinux developer for Fedora if you do not know), but I think he outlines that it does prevent the medium risk stuff which I think no base Linux system (without MAC systems (SELinux, RBAC, AppArmor,etc.), just DAC of Unix file permissions) would let pass easily. All the logs, all the non-root data which hackers would use to build up to move forward…
Does it? It let's someone dump a script in /tmp that can then be executed to have a shell into your system. With a shell, they can find other vector of attack, and escalate the privilege to root. You have to understand that even tho bash is the cause, a lot of other apps are now "vulnerable" including root enabled apps.
Re: What does SELinux do to contain the the bash exploit?
#13There are lots of stories of SELinux saves out there now. This is one I saw just recently:
https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved...
I myself have had several SELinux saves. It's definitely proven itself valuable as an additional security control.