The SELinux coloring book [pdf]

Post by eugeneionesco » Fri, Mar 03, 2017, 4:43 PM UTC

popobobo wrote: post #30

Wow, I glanced through it in 5 seconds. I am sure kids will love it. But it is just hard for me to read it carefully. Maybe I am just too old.

Post by eugeneionesco » Fri, Mar 03, 2017, 4:55 PM UTC

Dangeranger wrote: post #27

This trend of using illustration to explain complex topics is really wonderful. I know that people may criticize it as childish, but I find it helpful and enlightening. The illustrations that I've found most amazing and well done are created by people like: Lin Clark ( https://code-cartoons.com/ ) Julia Evans ( http://jvns.ca/zines/ ) Linda Liukas ( http://www.helloruby.com/ ) Amy Wibowo ( https://shop.bubblesort.io/…

Post by NoGravitas » Fri, Mar 03, 2017, 5:01 PM UTC

pricechild wrote: post #23

Moogs wrote: post #7

Earlier quoted context omitted.

If you're having issues with selinux run: sealert -a /var/log/audit/audit.log Most of the time, that will give you a detailed description of what's going wrong and tell you the command to fix it. Completely changed my opinion on selinux when I learned it. Also, the SELinux For Mere Mortals[1] talk is a great introduction. [1] https://www.youtube.com/watch?v=MxjenQ31b70&t=1s

It's nice... but the suggestions are often terrible when they could be fixed properly with a bool or changing the context of a directory. I sat the RHCE course/exam recently and the Red Hat trainer dealt with this in... amusing... ways. Unfortunately, fixing things properly requires knowledge, if only of where to find the information. Thinking solely about file contexts, it's not easy to for example search them. e.g.…

Post by Dangeranger » Fri, Mar 03, 2017, 5:11 PM UTC

eugeneionesco wrote: post #33

Dangeranger wrote: post #27

This trend of using illustration to explain complex topics is really wonderful. I know that people may criticize it as childish, but I find it helpful and enlightening. The illustrations that I've found most amazing and well done are created by people like: Lin Clark ( https://code-cartoons.com/ ) Julia Evans ( http://jvns.ca/zines/ ) Linda Liukas ( http://www.helloruby.com/ ) Amy Wibowo ( https://shop.bubblesort.io/…

>I personally believe that women have a better sense for simplifying complex ideas SELinux is not a "complex idea", SELinux is a tool with subpar documentation. A coloring book does nothing to fix that.

Post by blockoperation » Fri, Mar 03, 2017, 5:18 PM UTC

NoGravitas wrote: post #35

pricechild wrote: post #23

Earlier quoted context omitted.

It's nice... but the suggestions are often terrible when they could be fixed properly with a bool or changing the context of a directory. I sat the RHCE course/exam recently and the Red Hat trainer dealt with this in... amusing... ways. Unfortunately, fixing things properly requires knowledge, if only of where to find the information. Thinking solely about file contexts, it's not easy to for example search them. e.g.…

That "show me all contexts related to samba" is something I'm really missing. I worked one weekend on getting NextCloud to play nicely with SELinux and Apache on Fedora 25 without any dirty tricks, and one thing that would really have come in handy was an accurate list of all the labels related to Apache. The only comprehensive lists I could find online were out-of-date, and the only things that were up to date were…

  $ sesearch -A -s some_app_t -c file -p read -p write
  allow some_app_t some_type_t:file { read write };
  allow some_app_t some_other_type_t:file { read write };
  allow some_attribute_of_some_app_t yet_another_type_t:file { read write };

  $ sesearch -A -t some_type_t -c file -p read -p write
  allow some_app_t some_type_t:file { read write };
  allow some_other_app_t some_type_t:file { read write };