Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SELinux is unmanageable; just turn it off if it gets in your way

ctrl.blog

Post reply on HN
Print view View original

21–30 of 461 posts

Re: SELinux is unmanageable; just turn it off if it gets in your way

#21

Post by dylan604 »

After using CentOS for years, I have come to establish a debugging rule: If things just don't make sense, check if you're fighting SELinux policy. It's just one of those things that you beat your head on the desk after crashing into multiple brick walls that eventually works its way into your debugging process.

I guess it just shows how effective SELinux is if it is preventing the admin from doing something. /s

Re: SELinux is unmanageable; just turn it off if it gets in your way

#22

Post by vermilingua »

josephg wrote: post #11
nickysielicki wrote: post #7

Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/

There's something funny about a website about teaching security practices being unavailable through HTTPS. It looks like the website is hosted by github pages, and the author didn't bother setting up SSL correctly.

Is there anything on the site that needs to be secured with TLS? There's no authentication, no user details, why would it need to be secured?

Re: SELinux is unmanageable; just turn it off if it gets in your way

#23

Post by josephcsible »

SELinux has a horrible misfeature called dontaudit, that lets policies using it deny actions without any evidence being logged anywhere. Because of the existence of this, the only reliable way to know if a problem is being caused by SELinux is to temporarily disable it and see if the problem goes away.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#24

Post by perryizgr8 »

josephg wrote: post #11
nickysielicki wrote: post #7

Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/

There's something funny about a website about teaching security practices being unavailable through HTTPS. It looks like the website is hosted by github pages, and the author didn't bother setting up SSL correctly.

Why would you need SSL/HTTPS for a casual game like this?

Re: SELinux is unmanageable; just turn it off if it gets in your way

#25

Post by ximm »

mindwok wrote: post #2

As an experienced RHEL admin, a few years ago I probably would have said this is very bad advice in any professional context, and you should spend the time to learn it because it will save you one day. Now, I think my advice would be: Put everything in a container, and learn how to run Docker or Podman (or k8s) in a secure way (ie no root containers, be very careful with volume mounts, etc). Yes, they aren’t as matur…

I agree that containers are easier to manage than SELinux, but still not easy enough. Linux provides many low level primitives for restricting applications and SELinux, Apparmor, Docker, Flatpak, and systemd all provide high level abstractions for those. But IMHO none of them really finds a sweet spot between flexibility and usability. `systemd-analyze security` for example lists 80 (!) different settings, even though some of them are very high level such as `ProtectSystem`.

Containers have made the conceptual shift from allow/deny to isolate/share. Somehow this feels better even though it is effecitvely the same.

I am still waiting for an abstraction that uses all the low level features and wraps them in a high-level interface that puts usability front and center.

I am not sure if this is even possible though because many applications are not built with sandboxing in mind. Adding another file somewhere on the system that needs to be accessed is not considered a breaking change by most. So maybe we need a more fundamental shift.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#27

Post by deniska »

vermilingua wrote: post #22
josephg wrote: post #11

Earlier quoted context omitted.

There's something funny about a website about teaching security practices being unavailable through HTTPS. It looks like the website is hosted by github pages, and the author didn't bother setting up SSL correctly.

Is there anything on the site that needs to be secured with TLS? There's no authentication, no user details, why would it need to be secured?

So that your ISP, or someone else along the way, doesn't put a cryptocurrency miner into the page source.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#29

Post by durgampudi »

ungamedplayer wrote: post #18

The advice is poor and shows the authors lack of basic ability to understand basic selinux tooling. It's doubly bad because most people running modern Linux run their apps in containers and don't need to understand it as they don't run into problems. I'd this really is what gets the pageviews maybe someone should write a how-to on disabling all permissions because it's too hard.

No post body was provided.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#30

Post by withinrafael »

vermilingua wrote: post #22
josephg wrote: post #11

Earlier quoted context omitted.

There's something funny about a website about teaching security practices being unavailable through HTTPS. It looks like the website is hosted by github pages, and the author didn't bother setting up SSL correctly.

Is there anything on the site that needs to be secured with TLS? There's no authentication, no user details, why would it need to be secured?

Someone in the middle could teach you a variant of the material in hopes of creating more insecure servers out there. Or perhaps link to an "official companion app|pdf|exe" on the page.
Post reply on HN