SELinux vs. OpenBSD’s Default Security – OSnews

KernelTrap offers a summary of a lengthy debate on OpenBSD’s -misc mailing list comparing the security features built into OpenBSD versus the security offered by the Linux kernel’s SELinux feature. The main arguments presented against SELinux centered around its complexity and the difficulty of defining a secure policy. “The first thing people usually do with SELinux is turn it off”, suggests the article, noting that the ease with which it can be turned off is another security shortcoming. By contrast, OpenBSD offers numerous security features that are always enabled with minimal overhead, including propolice stack protection, random library mappings, proactive privilege separation, W^X, and systrace.