Post #2773686

@feistel@sns.feistel.party the answer to your question "Why was support for deny rules only added to the SELinux userspace in 2023?" is that SE Linux was based on a default deny model, you don't allow everything and just block things that seem bad you allow the things you need to allow. The theory is valid, but it doesn't mesh well with practices such as allowing access to socket_class_set for domains that probably don't even have software capable of doing that. Good theory + bad practices == problems