121–130 of 461 posts
> Red Hat Enterprise Linux (RHEL) has some of the most accessible documentation on creating custom policies. Red Hat is the Pinterest of Google searches for Linux problems. You’ll often find a page where someone is describing you problem but the resolution is locked behind a subscription login.
Earlier quoted context omitted.
> when you need to stay on bare metal What cases can linux containers not handle? Containers can access GPUs, /dev/kvm, block devices... I'm having trouble thinking of anything they can't do. After all, they're just processes in a glorified chroot, not that different from processes on the linux host.
Ultra-low latency applications on Linux are definitely one domain were containers are a big no-no for performance reasons. In my field (HFT) you won't find any serious performance-sensitive deployments using containers. So that's one example.
https://elixir.bootlin.com/linux/latest/source/include/linux...
For anyone curious or learning about SELinux, I highly recommend the SELinux Coloring Book [1] as an overview of core concepts. It doesn't go into any of the commands or mechanics of interacting with SELinux, but it has some simple and clear examples of objects, labels, and enforcement types. [1] https://people.redhat.com/duffy/selinux/selinux-coloring-boo...
I've always found that the concepts are not the difficult part of SELinux. Instead it's the complexity of the configuration and tooling which is always a headache.
There’s tons of good information on this part.
> Instead it's the complexity of the configuration and tooling which is always a headache.
There’s practically nothing on this. `man selinux` lists some of the tools (last updated in 2005) in “see also” section. On Fedora, half the referenced man pages are missing, though. You’ll need to read a book (or a book’s worth of man pages) to get anywhere.
Earlier quoted context omitted.
Is there anything on the site that needs to be secured with TLS? There's no authentication, no user details, why would it need to be secured?
Someone in the middle could teach you a variant of the material in hopes of creating more insecure servers out there. Or perhaps link to an "official companion app|pdf|exe" on the page.
Earlier quoted context omitted.
> and then you use ausearch and audit2allow to generate a module for it. And bi, while the selinux audit log entries (which ausearch shows) aren't super clear, That still sounds pretty complicated for most people. I mean, I know a lot of otherwise capable people who think NoScript is too much to manage and that's something I've heard repeated online many times. That's just clicks, and only when you actually need to a…
I agree, which is why I prefaced all that with "for sysadmin work", which I think has a different standard than for regular people.
The gist of the problems is that the policies are not transparent (probably due to security reasons?) to the user/admin, did I get that right? And that there's a difference in enforcement between user policies and policies provided by the distribution? All this sounds to me like a good idea that got lost in the implementation. If you have no way to look up which policies are in effect and what is labeled and how, som…
> The gist of the problems is that the policies are not transparent Yes. > (probably due to security reasons?) to the user/admin, did I get that right? No, that isn’t the reason. They’re open source. The policies are, simply put, compiled binary blobs from a comprehensive set of allow-rules and label-path definitions. The complexity of analyzing and difficulty in overriding these complex rulesets is the problem. Ther…
They are mentionned in the selinux documentation of your distro.
> Answering the question, “What do I need to label files that should be read by program X?” is waaay to hard. You’re expected to put your files in certain locations and then some things work out-of-the-box. However, there’s no documentation on where you’re supposed to put the files.
The default directories are usually mentionned in the manuals of those programs. If you are using an selinux based distro, you know that if you don't use those default dirs you will have to label your custom dir. This is not hard to understand nor to do.
As an experienced RHEL admin, a few years ago I probably would have said this is very bad advice in any professional context, and you should spend the time to learn it because it will save you one day. Now, I think my advice would be: Put everything in a container, and learn how to run Docker or Podman (or k8s) in a secure way (ie no root containers, be very careful with volume mounts, etc). Yes, they aren’t as matur…
Or just use Qubes OS: https://qubes-os.org.
As an experienced RHEL admin, a few years ago I probably would have said this is very bad advice in any professional context, and you should spend the time to learn it because it will save you one day. Now, I think my advice would be: Put everything in a container, and learn how to run Docker or Podman (or k8s) in a secure way (ie no root containers, be very careful with volume mounts, etc). Yes, they aren’t as matur…
AppArmor is great. It can do much of what SELinux does, but it uses plain configuration files as opposed to incredibly obscure and clunky filesystem-level hacks.
I was daemonizing a uvicorn (Python) process using systemd and could not get the Python script to write its log file anywhere. Not the current directory owned by the user, not elsewhere, and no errors showing up in the system logs.
After a few hours banging my head against the wall I discovered systemd's ReadWritePaths. Once I set that, it would log to any directory I specified.
It's the only service I've created where this has been necessary, and others write logs, so I have no idea why this one caused errors. If I did something wrong, let me know how this should be handled.
Earlier quoted context omitted.
Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages their customers visit for who knows what reason. HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing th…
> Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. And they would know that even with HTTPS. > Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. > HTTPS is…
Just move I guess.
> Red Hat Enterprise Linux (RHEL) has some of the most accessible documentation on creating custom policies. Red Hat is the Pinterest of Google searches for Linux problems. You’ll often find a page where someone is describing you problem but the resolution is locked behind a subscription login.