SELinux is unmanageable; just turn it off if it gets in your way

Post by throwaway889900 » Wed, Apr 27, 2022, 2:20 PM UTC

tristor wrote: post #282

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

Honestly, the bigger issue is that most SWEs just aren’t very good. It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles… System design, though, is the actual point of SW ENGINEERING. That’s the part that is responsible for creating a foundation of quality to build on. The other side is that sysadmins hav…

Post by dale_glass » Wed, Apr 27, 2022, 2:22 PM UTC

freeopinion wrote: post #293

lazyier wrote: post #280

Earlier quoted context omitted.

> The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. There are many many problems. One of the biggest problem with SELinux is that it is trying to graft Mandatory Access Controls on a userland that is not designed for it. Unix, frankly, is not designed for security. It is designed to get work done by writing a bunch of…

My android phone came without a calculator app. I recently realized this in a setting where I needed a calculator. I commented out loud about the lack of calculator and got some responses from the group I was in at the time. "Just download one from the app store," I was told. "But be prepared to grant it network access, file access, contacts access, camera access, and email privileges."

Post by tremon » Wed, Apr 27, 2022, 2:23 PM UTC

AceJohnny2 wrote: post #83

I see a few obvious areas of improvement, all of which are "implementation details" and don't undermine the core principles of SELinux. > The SELinux denial audit log messages are too vague. You’re told that a label was denied reading from another label. Okay, what do those labels mean? Which programs? Which files, sockets, or whatever? Improve logging in the SELinux system. Clearly it was able to map the program/fil…

Post by loeg » Wed, Apr 27, 2022, 2:24 PM UTC

tremon wrote: post #315

AceJohnny2 wrote: post #83

I see a few obvious areas of improvement, all of which are "implementation details" and don't undermine the core principles of SELinux. > The SELinux denial audit log messages are too vague. You’re told that a label was denied reading from another label. Okay, what do those labels mean? Which programs? Which files, sockets, or whatever? Improve logging in the SELinux system. Clearly it was able to map the program/fil…

Policy should be included with the software package I don't agree with this. When you do this, any malicious package can just ship a new policy that allows the maliciousness it's planning to do. By all means, split up the mega-policy into usable app-sized chunks, but shipping the policy in the same rpm as the application is self-defeating.

Post by dale_glass » Wed, Apr 27, 2022, 2:29 PM UTC

lakomen wrote: post #279

I've advocated for years that each program should be ran as its own user and group, isolated from the rest of the system. So let's say you run Firefox, is should run as firefox_username user and group. This way any exploit is ran with the user/group permissions, and unexploited it has no read write access outside its own user and group. Selinux is a beast but there are tools to help with determining which settings ne…