As a Fedora user for the last 5 years I have to admit... number of times SELinux prevented an malicious access: 0, number of times SELinux bricked the Fedora desktop: 3. Changes are often released, with selinux-policy catching up a week after.
SELinux is unmanageable; just turn it off if it gets in your way
211–220 of 461 posts
Re: SELinux is unmanageable; just turn it off if it gets in your way
#212The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…
The problem is that we have built all our software on Unix. The Unix security model is based on an attack model where users have to be protected from each other on a terminal server. Code is implicitly trusted and exploits were an unknown unknown. That security model is almost completely useless now. Terminal servers are an extreme edge case. Services implement their own security model between users. Special “Users”…
I agree with you, but if we look past the hack of dynamically creating new users per process, isn’t the security model “sufficient”? E.g. I believe android’s security is quite elegant with the different user per-process model, communicating only through IPC and with heavy use of SELinux (which is much more useful in this model).
Re: SELinux is unmanageable; just turn it off if it gets in your way
#213Earlier quoted context omitted.
Why would you need SSL/HTTPS for a casual game like this?
Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages their customers visit for who knows what reason. HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing th…
What is the concern with these logs? Do they contain end user information? May be IP, anything else?
Re: SELinux is unmanageable; just turn it off if it gets in your way
#214> Red Hat Enterprise Linux (RHEL) has some of the most accessible documentation on creating custom policies. Red Hat is the Pinterest of Google searches for Linux problems. You’ll often find a page where someone is describing you problem but the resolution is locked behind a subscription login.
You can get to some of the resolutions (but not all) with a free RH developer account.
This is not true. A free Red Hat developer account has access to the same resolution content as a paid account.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#215Earlier quoted context omitted.
Why would you need SSL/HTTPS for a casual game like this?
Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages their customers visit for who knows what reason. HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing th…
Also technology wise its not 2022 everywhere, if you know what i mean.
Many poorer nations suffer from inferior infrastructure, which could mean slower loading / processing times for https based webpages.
I remember reading an article along these lines a few years ago when arguing against using https absolutely everywhere.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#216Earlier quoted context omitted.
> but you can't understand it or change anything" That is not true. SELinux is not hard to understand nor change. Most of the issues you might encounter are simply solved by changing a label in a file or directory. It is just not straightforward to debug and understand if you don't know it is there. I think most people who complain about it are multi distros/OS users and just only realize after losing precious time t…
But what am I, as the sysadmin, supposed to label things? Even if I know that I probably need to apply some labels, how do I find out what the policies are? What labels can interact with this program? You can turn to Google and find some incantations in a blog or forum post from ten years ago, but you can‘t easily see which labels a program is allowed to interact with or not. (If you even know to ask that question.)
sesearch -A
That shows the list of what labels are allowed to do what to which labels, so run ps -Z to get the label of your process and grep the sesearch output for it, and that will tell you what labels it's allowed to interact with and in what ways.
selinux is generally pretty straightforward, but it has a reputation for being impenetrable which puts people of trying to learn it.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#217No post body was provided.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#218The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…
SELinux is so ridiculous.
If you want a real security on linux where root is not God !
Go to this site.
It's little difficult to implement (by kernel customisation) but there is a learning mode to secure all Linux structure
Be "root" is not be "God" after implementation. You will must ask to Security Officer (SecOff)
You can speak of "Evaluation Assurance Level" with this security solution and push SELinux into a trash.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#219The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…
I would argue that the fundamental problem is that the companies selling software "engineering" products do not actually take any responsibility that the product they have engineered works as intended. (see: https://www.snopes.com/fact-check/car-balk/ ) And of course, the main reason they do not take the responsibility is that the customers won't pay for it. It is kind of interesting. We are very good at making bridg…
The engineer building the bridge is liable. Hence, you get engineers with qualifications (instead of a random person with X years in Y), and those qualifications certify they know what they are doing.
Re: SELinux is unmanageable; just turn it off if it gets in your way
#220The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…
Uhh isn't this precisely what the whole snap/flatpak movement is trying to fix?
I can talk about snaps, but at least they are offering a specific permission model which is usable for users to understand. i.e. Via the interfaces, I can know software x accesses my password-manager, home directory, camera etc... I can disconnect access to the given permission and have it enforced via the kernel and apparmor.
The applications themselves bundle only libraries that themselves are sandboxed/snapped.