I have fiddled around with both SELinux and Apparmor recently and found these tools invaluable for preventing a spread of damage from a compromised context via one process, whereby and attacker could exploit a buffer overflow or underflow, eventually pushing a new return address on the local call stack, which if I am correct can lead to exec() calls or even a root shell via say, su -
Learning Unix & Linux is very interesting to me, and I want some of the more seasonsed people here to please offer me some basic reflection on this topic. Are these tools really overkill for a desktop or non government secure/business context, whereby a serious say, rootkit intrusion can be detected by analyzing the integrity of the System.map file for any rogue entries, and checking of package integrity etc. Say, a remote intrustion on these systems isn't a massive deal following cleanup, so prevention via MAC is overkill?
No system is perfect, but would I be correct in making the assumption that on a basic desktop system, passwordless key based logins/swipe card and disabling remote logins via ssh etc, not to mention patching the system and disabling root work on any console, virtual or similar, except for console tty1, which is physically isolated from rogue user programs like firefox, would this setup be "ok" for most intents and purposes, or should MAC reside on ALL systems?
Keep in mind most Linux distributions out there DO NOT offer MAC as a default. Fedora and CentOS/RedHat appear to be the only two well known ones to offer out of the box MAC.Thanks:)