SELinux is unmanageable; just turn it off if it gets in your way
1–10 of 461 posts
Re: SELinux is unmanageable; just turn it off if it gets in your way
#2As an experienced RHEL admin, a few years ago I probably would have said this is very bad advice in any professional context, and you should spend the time to learn it because it will save you one day.
Now, I think my advice would be: Put everything in a container, and learn how to run Docker or Podman (or k8s) in a secure way (ie no root containers, be very careful with volume mounts, etc). Yes, they aren’t as mature as SELinux, but containers aim to provide many of the same benefits that SELinux does (and even more) except in a way that’s much easier to manage. Even better is that these container runtimes often come with SELinux and AppArmor policies out of the box on good Linux distros.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#3As an experienced RHEL admin, a few years ago I probably would have said this is very bad advice in any professional context, and you should spend the time to learn it because it will save you one day. Now, I think my advice would be: Put everything in a container, and learn how to run Docker or Podman (or k8s) in a secure way (ie no root containers, be very careful with volume mounts, etc). Yes, they aren’t as matur…
I was about to argue with you until I read to your last point. Totally agree one of the great things about containers is indeed they integrate very well with various Mandatory Access Control implementations SELinux included and don't generally require specialized policies for each app.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#4> There’s nowhere on the system where you can view the policies and look up why something might or might not work.
I always thought I had to be missing something with SELinux because this is what it seemed like to me and that can't be right. My impression is that the documentation for SELinux is extensive in all of the areas that aren't affecting you but it's really hard to nail down exactly what the policies are, what labels are available, which labels you should be using, and generally how everything interacts. Is there a SELinux Wiki somewhere that I've missed that has a simple breakdown of each and every possible label with interactions? Some tool I can use to generate said list?
Re: SELinux is unmanageable; just turn it off if it gets in your way
#5I came to the same conclusion, but in my case the problem was that there were no audit messages for one particular denial. After a week or two of investigation I finally found the solution. But, I decided that I simply couldn't trust selinux any more, so I turned it off.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#6I like apparmor better. Set it up for high attack surface apps like browsers and vms.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#7Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/
Re: SELinux is unmanageable; just turn it off if it gets in your way
#8Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/
Ironic (maybe intentional?) that this site doesn't use TLS.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#9Off-topic, but the polite “disable your adblocker” message unobtrusively displayed at the end of the article is a nice way to do it. Lets me know I can support the site that way without hindering the reading experience.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#10Is the information being hidden intentionally to prevent attackers from gaining a toe-hold?