| ▲ | nobody42 2 hours ago | |
And it's a proper way to use computer nowadays. Apart from high-overhead solutions like VMs and containers, there are seamless and maintenance-free solutions (after the initial setup): - systemd service hardening [0] [1] pretty powerful, but it's a blacklist approach - whack-a-mole - AppArmor [2] Whitelist, proactive approach. Contrary to SElinux, it's not a programming language, and could be grasped pretty quickly. I made a tool to easily convert AA logs into usable rules. [3] [0] https://github.com/alegrey91/systemd-service-hardening [1] https://github.com/desbma/shh | ||