Heureusement que un système avec SELinux est pas strictement moins sécurisé qu'un système sans...
Mais ça change rien au fait que sous fedora on peut mapper NULL, sans passer par des tricks de personnalité, malgré la configuration de mmap_min_addr: http://lwn.net/Articles/342330/
[...] the mmap() code in the 2.6.30 kernel explicitly declines to enforce mmap_min_addr if the security module mechanism has been configured into the kernel. Security module checks are supposed to be additive to the checks which are already made by the kernel, but it didn't work that way this time; with regard to page zero, security modules can grant access which would otherwise be denied. To complete the failure, Red Hat's default SELinux policy allows mapping the zero page. So, in this case, running SELinux actually decreased the security of the system.
[^] # Re: (donc les systèmes utilisant SELinux sont vulnérables).
Posté par ribwund . En réponse au journal Encore un trou de sécurité, encore Brad qui s'amuse.... Évalué à 3.
Mais ça change rien au fait que sous fedora on peut mapper NULL, sans passer par des tricks de personnalité, malgré la configuration de mmap_min_addr:
http://lwn.net/Articles/342330/
[...] the mmap() code in the 2.6.30 kernel explicitly declines to enforce mmap_min_addr if the security module mechanism has been configured into the kernel. Security module checks are supposed to be additive to the checks which are already made by the kernel, but it didn't work that way this time; with regard to page zero, security modules can grant access which would otherwise be denied. To complete the failure, Red Hat's default SELinux policy allows mapping the zero page. So, in this case, running SELinux actually decreased the security of the system.