Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SELinux is unmanageable; just turn it off if it gets in your way

ctrl.blog

Post reply on HN
Print view View original

371–380 of 461 posts

Re: SELinux is unmanageable; just turn it off if it gets in your way

#371

Post by goombacloud »

The difference between SELinux policies and the systemd security settings for locking down a service is about integration and where they are maintained. The SELinux policies are not integrated well with the applications and normally the apps don't think about shipping their own SELinux policy tweaks. With systemd security settings this is much different because the app normally provides the systemd service file and the security settings are part of it and maintained by the app developers.

Edit: With AppArmor it's similar and the app devs normally don't think about providing an AppArmor profile but I think it's at least a bit easier than with SELinux policies.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#372

Post by mwcampbell »

api wrote: post #318
steelframe wrote: post #285

Earlier quoted context omitted.

"We have an isolation problem. Let's use a VM!" Congratulations, you have just introduced an L1TF attack surface, and the bad guys are now freely reading all physical memory.

You have traded an absolutely enormous attack surface of hundreds of syscalls and a whole system full of files and apps for a much narrower attack surface involving the CPU and whatever the hypervisor exposes which can just be virtio-style pseudo-devices. Besides if the CPU is vulnerable than regular apps can probably exploit it too. Also I didn't say the best approach would necessarily be hardware VMs, though that i…

The problem I see with wasm as the sole basis for a secure app platform is that then a web browser can't be just another app on that platform, unless the performance of the browser's JS engine is hobbled or perhaps wasm gets some kind of JIT compilation support. So maybe the web browser engine needs to be the platform, as in Chromium OS, although even Chromium OS has now compromised that original purity with support for Android and desktop Linux VMs.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#373

Post by jnwatson »

themulticaster wrote: post #245
legulere wrote: post #201

Earlier quoted context omitted.

The problem is that we have built all our software on Unix. The Unix security model is based on an attack model where users have to be protected from each other on a terminal server. Code is implicitly trusted and exploits were an unknown unknown. That security model is almost completely useless now. Terminal servers are an extreme edge case. Services implement their own security model between users. Special “Users”…

I agree with your points about the Unix threat model being designed around protecting users from each other, but for completeness I'd like to point out that while modern Linux/BSD systems ship with Discretionary Access Control (DAC) by default, SELinux implements a Mandatory Access Control (MAC) system which is much more fine grained. SELinux is not limited to the traditional Unix security model. Short simplified exa…

The point of the article is that actually using a fine-grained MAC model is inconsistent with the way we actually use our tools.

It requires deep understand of both the application and the model, which requires a lot of work.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#374

Post by api »

mwcampbell wrote: post #372
api wrote: post #318

Earlier quoted context omitted.

You have traded an absolutely enormous attack surface of hundreds of syscalls and a whole system full of files and apps for a much narrower attack surface involving the CPU and whatever the hypervisor exposes which can just be virtio-style pseudo-devices. Besides if the CPU is vulnerable than regular apps can probably exploit it too. Also I didn't say the best approach would necessarily be hardware VMs, though that i…

The problem I see with wasm as the sole basis for a secure app platform is that then a web browser can't be just another app on that platform, unless the performance of the browser's JS engine is hobbled or perhaps wasm gets some kind of JIT compilation support. So maybe the web browser engine needs to be the platform, as in Chromium OS, although even Chromium OS has now compromised that original purity with support…

Using VMs like this means the VM itself becomes hard-core security-critical but if apps have stupid bugs their damage is quite limited.

It also means you can mitigate things like Spectre or RowHammer by just tweaking how the VM JIT compiles bytecode into machine code. You don't have to update apps or even the kernel per se (though the latter would be a good idea).

Re: SELinux is unmanageable; just turn it off if it gets in your way

#375

Post by chousuke »

at_a_remove wrote: post #325

I tried SELinux perhaps too early and found that, unless I was right on the happy path, I simply couldn't get anything to run. I recall a feeling of victory after finally being able to multihost some websites. However, I am not a great sysadmin and was pressed into service at the time. It feels good to know that I was not the only one.

One trick that makes SELinux on RHEL much less of a bother is to always use the system-provided default paths for data and logs, and just mount additional volumes for data at these paths.

The vast majority of SELinux trouble I've seen stems from people customizing things needlessly and then they need to adjust the default policies.

Another common problem is not separating the OS / application binaries, configuration / data and log directories, which is just bad hygiene even without SELinux. I've seen many installs where people have just dropped their stuff in /home/ec2-user and then the whole server breaks at some point because / gets filled by a sudden burst of log entries.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#376

Post by [deleted] »

tristor wrote: post #282
fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

Honestly, the bigger issue is that most SWEs just aren’t very good. It’s extremely telling that when you spend time in tech forums most people dread system design questions as the harder side of interviewing for senior level SWE roles… System design, though, is the actual point of SW ENGINEERING. That’s the part that is responsible for creating a foundation of quality to build on. The other side is that sysadmins hav…

[deleted]

Re: SELinux is unmanageable; just turn it off if it gets in your way

#377

Post by paledot »

caymanjim wrote: post #303
paledot wrote: post #286

Earlier quoted context omitted.

If something isn't secure, it doesn't work. At that point, you would've been better off shipping a wireframe.

A door with a broken lock still provides value. An online PDF converter on a website without SSL still provides value. I'm not saying security doesn't matter or that it shouldn't be a priority, but things don't need to be perfect to be useful. It makes sense to focus more on functionality than security in many areas. I host a bunch of web apps behind a firewall that aren't secure enough to expose to the public Intern…

Unfortunately, that's exactly the problem. If it didn't provide value, no one would use it and its lack of security would be a moot point.

The PDF converter is a great example. It's functional, people use it - to transfer potentially highly sensitive documents over an insecure connection. At that point, it provides value in the same way that a Nigerian prince provides banking services.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#378

Post by kbenson »

d2wa wrote: post #125
kbenson wrote: post #99

Earlier quoted context omitted.

I agree, which is why I prefaced all that with "for sysadmin work", which I think has a different standard than for regular people.

Sysadmins are just regular people with more experience. Sometimes, regular people even become sysadmins! ;)

This is a common misconception. No normal person ever becomes a sysadmin. In the cases where you think that has happened, they invariably fly their freak flag high soon after. ;)

Re: SELinux is unmanageable; just turn it off if it gets in your way

#379

Post by topspin »

pkrumins wrote: post #167
shp0ngle wrote: post #40

Earlier quoted context omitted.

>As soon as you install a new system, turn it off good advice > together with systemd lol why

Because we didn’t ask for systemd. We like init scripts that we actually understand.

systemd isn't difficult to understand.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#380

Post by darksaints »

I just can't get over the fact that it comes from the NSA. Sure, it might be more secure, when properly configured, than without it. But it's the fucking NSA. The same agency that backdoored Dual_EC_DRBG. They're ostensibly an agency that is supposed to protect us from malicious digital threats, but they have always sacrificed that mission any time they have had the chance. I will never trust them, and I say that as a family member of someone in the NSA.

SEL4-based OSes can't come fast enough.

Post reply on HN