SELinux is unmanageable; just turn it off if it gets in your way • Hacker News Board

Re: SELinux is unmanageable; just turn it off if it gets in your way

#291

Post by vsareto » Wed, Apr 27, 2022, 1:51 PM UTC

tristor wrote: post #282

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

Honestly, the bigger issue is that most SWEs just aren’t very good. It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles… System design, though, is the actual point of SW ENGINEERING. That’s the part that is responsible for creating a foundation of quality to build on. The other side is that sysadmins hav…

I think most devs see that the jobs are asking for overloaded responsibilities from multiple other jobs and they're trying to live up to that. It also became the norm to see job postings which would have been 3-4 distinct positions a decade back.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#292

Post by Asooka » Wed, Apr 27, 2022, 1:53 PM UTC

dale_glass wrote: post #152

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

Some of the problem is that historically we've built systems badly engineered for security. Take for instance something like xscreensaver. Something in there needs to be setuid so that it can verify your password to unlock the screen. That something is fortunately a dedicated binary, and not every single screensaver, but still, that's bad. Writing that executable is a delicate thing. Get one of them wrong, and it's a…

What's the difference between a service that you send a string to and get a string back and a binary that you execute with a string argument and it prints a string argument back? I quite like the latter, as you're free from keeping state and thus have a smaller attack surface or potential to leak resources. Of course one difference is the execution environment, with a systemd service you can have it set up exactly as it should be so no changes to LD_LIBRARY_PATH &c can poke holes. I wonder if its socket activation feature can be used like a sort of CGI server - for each connection on a socket, run the binary in a controlled environment and connect its stdin/out to the socket, with stderr going to a log file.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#293

Post by freeopinion » Wed, Apr 27, 2022, 1:58 PM UTC

lazyier wrote: post #280

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

> The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. There are many many problems. One of the biggest problem with SELinux is that it is trying to graft Mandatory Access Controls on a userland that is not designed for it. Unix, frankly, is not designed for security. It is designed to get work done by writing a bunch of…

My android phone came without a calculator app. I recently realized this in a setting where I needed a calculator. I commented out loud about the lack of calculator and got some responses from the group I was in at the time.

"Just download one from the app store," I was told. "But be prepared to grant it network access, file access, contacts access, camera access, and email privileges."

Re: SELinux is unmanageable; just turn it off if it gets in your way

#294

Post by egberts1 » Wed, Apr 27, 2022, 1:59 PM UTC

NoGravitas wrote: post #266

egberts1 wrote: post #156

Earlier quoted context omitted.

Yet another rabbit hole has emerge. And it is called “systemd”. What a great time to be a Linux system administrator.

Compared to selinux, though, the systemd documentation is excellent, and the tools for observing the state of the system are very good.

Excellent? Whew. You must be privy to some private systemd dictionary somewhere.

Meanwhile, I am holding my own just fine, latest systemd-wise.

https://GitHub.com/egberts/easy-admin/blob/main/500-dns/512-...

It is all about reading the friggin’ source code … of systemd.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#295

Post by tremon » Wed, Apr 27, 2022, 2:00 PM UTC

gitgud wrote: post #254

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

> " The problem is not so much that selinux is too complicated (it is as complicated as it needs to be)... " Completely disagree, if the target users are advising each other to disable it... then the tool is definitely more complicated than it needs to be. Using tools that don't hide any complexity are very painful to use. It feels like the creator doesn't care about the user and put no thought into the display of in…

if the target users are advising each other to disable it... then the tool is definitely more complicated than it needs to be.

This does not follow. I you ask a 5-year to repaint the Sistine Chapel and the result is somehow less than stellar, are you similarly going to blame the paintbrushes used? There exists no situation where the task at hand is too complicated for the user?

Re: SELinux is unmanageable; just turn it off if it gets in your way

#296

Post by kodah » Wed, Apr 27, 2022, 2:02 PM UTC

> Now, most sysadmins are probably not aware of SELinux nor its policy set until they can’t achieve something because it violates the policies.

First, many applications come with SELinux policies. For the ones that don't, users will need to create a pipeline. When I've written custom apps I usually have a "soak test" pipeline whereby the application runs through all of its commands and configuration and we capture denials, produce a policy with audit2allow and then review the syscalls to ensure they match what we'd expect from the application.

If you're logging into a box or receiving an OS image that has SELinux turned on and you don't know how to query, that bit is just a lack of knowledge. It's a very simple command and there's a finite number of modes.

The wider problem is that enterprises beyond FAANG have a very tough time perceiving systems as a product or systems engineers as anything beyond advanced troubleshooters. That's why you get these huge OS bakeries that ship out a cookie cutter system that everyone must use, or else. This is all usually motivated by compliance.

On top of that, while at enterprises I've noticed that they'll teach all the courses in the world about programming and databases yet there's conspicuously no classes to hone your skills as a systems engineer. The pipeline I mentioned earlier isn't magic, I came up with the idea because I understand the workflow of SELinux and I know enough about syscalls to interrogate my own code. It's kind of like the people who like to read machine code and compare it to their application but for a systems engineer. There should be classes for the kernel and userland alike. Point being, because enterprises commonly view the system as a checkbox rather than a product, or worse produce an undocumented cookie cutter product with "best practices" it harms the profession of systems engineering.

Coincidentally, this is also why I mainly use the title "Software Engineer" rather than "Systems Engineer" with big corps.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#297

Post by marcosdumay » Wed, Apr 27, 2022, 2:02 PM UTC

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

> Obscure files like /etc/localtime, /etc/resolv.conf, /etc/ld.so.conf, /dev/zero ... how can you expect devs to build well documented and well sandboxable applications if they don't know which files their library functions will open?

Who the fuck invented that convention that fine-grained permissions must be file-based? It's insane. No, no developer will anticipate that he needs to read /etc/nsswitch.conf. No developer should. A developer should anticipate that the software needs permission to connect on network hosts.

As much as it is too granular, file based permissions aren't fine-grained enough. Asking to connect on random hosts is absurdly wide, most programs only need to connect in to a few of them, or connect to an user-supplied host (that can be a permission by itself).

Anyway, yes, the manpages should interlink better. What is a different issue.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#298

Post by Sebb767 » Wed, Apr 27, 2022, 2:03 PM UTC

icedchai wrote: post #277

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

Containers are more like a trash bag. Nobody expects it to be air tight, just good enough to make it to the dumpster. I always felt containers were always about packaging and deployment, not security. Any "security" was a byproduct of isolation, not an end goal.

I fully agree with your last point. In my experience, the all-versions-packaged approach of containers actually leads to a worse patch state than a simple Ubuntu or Debian installation with unattended-upgrades.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#299

Post by Godel_unicode » Wed, Apr 27, 2022, 2:03 PM UTC

Frost1x wrote: post #265

lucideer wrote: post #255

Earlier quoted context omitted.

> The problem is not so much that selinux is too complicated (it is as complicated as it needs to be) I disagree. > but that we all run software we don't understand. I fully agree. My disagreement lies in the fact that you've described the problem, but are proposing that some software (SELinux) that fails to solve the problem is somehow good. SELinux might be a perfect tool in an ideal utopia where everyone understan…

>My disagreement lies in the fact that you've described the problem, but are proposing that some software (SELinux) that fails to solve the problem is somehow good. My opinion is that there's a cultural and policy problem and you're simply not going to solve it with technology. I don't think SE Linux is bad, it just isn't the answer here. One (clearly not the only) main reasons people just run a bunch of software the…

> otherwise they wouldn't be practicing any form of engineering.

This is incorrect. The dirty little secret here is that software engineering is an extremely lucrative career, and a ton of people have gotten into the field for that reason. I'm not saying they're wrong to do so, but I have never met a wizard who didn't love the craft. I have met tons of people faking-it-till-they-make-it who are there for the RSUs and free food. The latter tend to practice resume-driven development, and tend to have very little idea how their code actually works.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#300

Post by rr808 » Wed, Apr 27, 2022, 2:06 PM UTC

tristor wrote: post #282

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

Honestly, the bigger issue is that most SWEs just aren’t very good. It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles… System design, though, is the actual point of SW ENGINEERING. That’s the part that is responsible for creating a foundation of quality to build on. The other side is that sysadmins hav…

> Honestly, the bigger issue is that most SWEs just aren’t very good. It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles…

I think this is a bit unfair, the software industry is so big now there are lots of different sub-sectors. Big Tech companies have huge scale problems that are kind of unique. Most developers work on products that only have a few hundred users at a time.

Your 20 years experience is a bit telling. I'm the same age, back then SWEs usually had full access to production environments. Now everything is segregated and devs can't experiment in prod and end up getting detached.