Hacker News new | ask | show | jobs
by azinman2 1416 days ago
My thoughts exactly. If you can sudo, isn’t it already game over?
2 comments

But that was the entire point of SIP, wasn't it? To mitigate the impact of a compromised root account. If it doesn't work, then what's the point of going to all this effort in the first place?
Think SELinux.

sudo is bad, but it is not worse.

Like SELinux, you are not supposed to be able to disable without reboot.

Wouldn’t `setenforce 0` be essentially “disabling” SELinux without a reboot?
Puts it in 'permissive' mode, i.e. 'audit but don't deny'. Disabling (i.e. no auditing either, no record) requires a reboot I believe (a change to kernel param).