alt Hacker NewsAny LSM can stop that POST. SELinux, AppArmor, Tomoyo, etc. They are built-in to the kernel. You just need to know what you are doing to use them.
Any LSM can stop that POST. SELinux, AppArmor, Tomoyo, etc. They are built-in to the kernel. You just need to know what you are doing to use them.
Yes, but they operate at the OS boundary, but we are defining application/business logic
OS controls answer "can this process make network requests?"
App-level policies answer "is this request, with these parameters, acceptable?"