<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">it's not the apparmour or selinux are not the answer, it's just the question<br>that they are answering is wrong.<br><br>Securing Cgi scripts? hmm..... good luck ;-)<br><br>--- On <b>Tue, 21/4/09, gordon dunlop <i><astrozubenel@googlemail.com></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;">From: gordon dunlop <astrozubenel@googlemail.com><br>Subject: Re: [dundee] Opinionated much?<br>To: "Tayside Linux User Group" <dundee@lists.lug.org.uk><br>Date: Tuesday, 21 April, 2009, 4:14 PM<br><br><div id="yiv174832179"><br><br><div class="gmail_quote">2009/4/21 Jennifer higgins <span dir="ltr"><<a rel="nofollow" target="_blank" href="mailto:sauntering.with.scissors@gmail.com">sauntering.with.scissors@gmail.com</a>></span><br><blockquote class="gmail_quote" style="border-left:
1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<p>Just finished a report on kernel level firewalls in operating
systems and realised that it’s a great big rant about user freedom! <br></p><p>Oops.. </p>
<p>Just thought i’d share that with some like minded people. I
found it quite amusing. <br></p><p>Not amusing that I’m probably going to have to re-write
the damn thing though. Sigh!</p></blockquote><div><br> I think it's a very topical subject, security versus user freedom. Linus Torvalds had this to say about security and bug fixing (to reduce insecurities):<br><br>
<a rel="nofollow" target="_blank" href="http://www.networkworld.com/news/2008/081408-torvalds-security-circus.html">http://www.networkworld.com/news/2008/081408-torvalds-security-circus.html</a><br><br>Whilst I am not looking at kernel level firewalls, I have been looking at SELinux the past week which has kernel and user access controls. I have had it disabled for years in my Fedora systems because it was such a pain in the ass, but I am now looking at in Centos 5.3 for the new TayLUG website which I'm working on at the moment.<br>
<br>A thread about SELinux & OpenBSD security:<br><br><a rel="nofollow" target="_blank" href="http://kerneltrap.org/OpenBSD/SELinux_vs_OpenBSDs_Default_Security">http://kerneltrap.org/OpenBSD/SELinux_vs_OpenBSDs_Default_Security</a><br><br>The anatomy of SELinux:<br>
<br><a rel="nofollow" target="_blank" href="http://www.ibm.com/developerworks/linux/library/l-selinux/?ca=dgr-lnxw02aSELinuxAnat&S_TACT=105AGX59&S_CMP=GR">http://www.ibm.com/developerworks/linux/library/l-selinux/?ca=dgr-lnxw02aSELinuxAnat&S_TACT=105AGX59&S_CMP=GR</a><br>
<br>I am still finding it a pain in the butt trying to write policy rules and for giving different permissions to the various cgi scripts. I realised that with all the things I hope to implement on the web site it will just not work. On Dan Walsh's blog he says it is now easier to use SELinux as it has newer capabilities, come off it Dan who are you kidding!!<br>
<br><a rel="nofollow" target="_blank" href="http://danwalsh.livejournal.com/24537.html">http://danwalsh.livejournal.com/24537.html</a> <br><br>So I am not going to bother using it, no wonder people have it either turned off or in permissive mode. It is like trying to type on a keyboard with a straitjacket on.<br>
<br>Gordon<br><br> <br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
<br>_______________________________________________<br>
dundee GNU/Linux Users Group mailing list<br>
<a rel="nofollow" target="_blank" href="mailto:dundee@lists.lug.org.uk">dundee@lists.lug.org.uk</a> <a rel="nofollow" target="_blank" href="http://dundee.lug.org.uk">http://dundee.lug.org.uk</a><br>
<a rel="nofollow" target="_blank" href="https://mailman.lug.org.uk/mailman/listinfo/dundee">https://mailman.lug.org.uk/mailman/listinfo/dundee</a><br>
Chat on IRC, #tlug on <a rel="nofollow" target="_blank" href="http://dundee.lug.org.uk">dundee.lug.org.uk</a><br></blockquote></div><br>
</div><pre>_______________________________________________<br>dundee GNU/Linux Users Group mailing list<br>dundee@lists.lug.org.uk http://dundee.lug.org.uk<br>https://mailman.lug.org.uk/mailman/listinfo/dundee<br>Chat on IRC, #tlug on dundee.lug.org.uk</pre></blockquote></td></tr></table><br>