Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SELinux is unmanageable; just turn it off if it gets in your way

ctrl.blog

Post reply on HN
Print view View original

391–400 of 461 posts

Re: SELinux is unmanageable; just turn it off if it gets in your way

#391

Post by [deleted] »

monkpit wrote: post #383
greedo wrote: post #354

Earlier quoted context omitted.

I'm actually agnostic as to how it's achieved. I just think that the idea of running a container for three months without patching the underlying OS is nuts. Generally our guys only redeploy a container when there's been an update, so that OS is pretty stale compared to what I'm running on traditional VMs. It really was more of a reflection on how DevOps can become too focused on application development and deploymen…

Ah, the OS itself. I thought you meant the application dependencies.

[deleted]

Re: SELinux is unmanageable; just turn it off if it gets in your way

#392

Post by [deleted] »

Spivak wrote: post #384
greedo wrote: post #354

Earlier quoted context omitted.

I'm actually agnostic as to how it's achieved. I just think that the idea of running a container for three months without patching the underlying OS is nuts. Generally our guys only redeploy a container when there's been an update, so that OS is pretty stale compared to what I'm running on traditional VMs. It really was more of a reflection on how DevOps can become too focused on application development and deploymen…

I kinda stopped worrying too much about it because the "OS" (really userspace) that lives in a container isn't in a position to be exploited like the underlying VM OS is. Nothing in the container is privileged and there are no security boundaries that exist within a container. You should care exactly as much about container image updates as you do gem/npm/pip updates and I guarantee you have months old deps pinned in…

[deleted]

Re: SELinux is unmanageable; just turn it off if it gets in your way

#393

Post by legalcorrection »

ximm wrote: post #364
tinco wrote: post #235

Earlier quoted context omitted.

In my opinion, if an application requires more access than a docker container gives by default, then that application should probably just run in a VM. If the application needs more access because it needs to manage or control some hardware, then it should be tailored to the O/S and have a small core service that runs naked under systemd or whatever. If fancy management of that core service is needed, it can expose a…

What about an application like vim? It should be able to access any file I pass that is explicitly opened, but not much more. That is hard to express with current tooling.

You could do it with a file picker API that opened an out-of-process file picker. I'm pretty sure this is how WinRT works. Would be tricky for a purely command line workflow, but very doable with a GUI.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#394

Post by xyzzy123 »

Spivak wrote: post #384
greedo wrote: post #354

Earlier quoted context omitted.

I'm actually agnostic as to how it's achieved. I just think that the idea of running a container for three months without patching the underlying OS is nuts. Generally our guys only redeploy a container when there's been an update, so that OS is pretty stale compared to what I'm running on traditional VMs. It really was more of a reflection on how DevOps can become too focused on application development and deploymen…

I kinda stopped worrying too much about it because the "OS" (really userspace) that lives in a container isn't in a position to be exploited like the underlying VM OS is. Nothing in the container is privileged and there are no security boundaries that exist within a container. You should care exactly as much about container image updates as you do gem/npm/pip updates and I guarantee you have months old deps pinned in…

Ok you got me (I laughed)

I'm just so sick of the container security shills; in particular I'm tired of people selling debian advisories with zero value add on enterprise contract.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#395

Post by StillBored »

The problem of selinux getting in the way of being able to boot/login has been going on for years. Tossing selinux=0 on the grub/kernel command line anytime the machine fails to boot is common for most people running rawhide. Which itself is a problem because relabeling can take a _long_ time if the system in question has a large filesystem.

Selinux has stopped a number of active exploits, but OTOH, its probably stopped 100x as many perfectly functional systems from working.

So more selective enforcement is probably the right path, and one that systemd seems to be going down as it attempts to secure services it manages, but right now welding the door shut to stop the bad guys seems like the solution we are stuck with.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#396

Post by StillBored »

fefe23 wrote: post #134

The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. The whole IT ecosystem has become a hail mary. Even admins usually have no idea what a certain program actually wants to do. If the admin knows how to install the app so that it actually runs, you call them a good admin. From a security point of view, an application is…

containerization is less about security these days, and is being used to work around the broken package/dependency management situation on linux which is caused by the wild west of libraries that make little effort to assure any kind of forward/backwards compatibility. Given the fact that distro package maintainers cant maintain 30x different versions of any given package to satisfy all the applications stuck on a particular library version, means that larger applications which can't be constantly churning their code bases to replace foo(x,y) with foo_bar(y,x) are stuck shipping their own pinned version of a library.

So, I don't think anyone seriously thought that containers provided significantly more security than simply running an application and trusting the kernel syscall and filesystem permissions were bulletproof. More software layers are unlikely to improve security.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#397

Post by htkibar »

vaylian wrote: post #341
lazyier wrote: post #305

Earlier quoted context omitted.

The alternative, which is Linux, is to grant your calculator app the permissions to read and write to the same resources that your browser uses to store the password for your bank. Well "grant" is too strong of a word. "By default and there is nothing you can do about it unless you are exceptionally skilled" is more accurate. Also your calculator app can read your sudo password as you type it, which you do a dozen ti…

> Also your calculator app can read your sudo password as you type it True with X11. Fixed in Wayland.

Which is still not the standard - probably will take at least a decade before we can even talk about this issue being fixed.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#398

Post by zamalek »

afr0ck wrote: post #348
lazyier wrote: post #280

Earlier quoted context omitted.

> The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. There are many many problems. One of the biggest problem with SELinux is that it is trying to graft Mandatory Access Controls on a userland that is not designed for it. Unix, frankly, is not designed for security. It is designed to get work done by writing a bunch of…

a.k.a container.

You really shouldn't rely on containers for this, unfortunately.

Re: SELinux is unmanageable; just turn it off if it gets in your way

#399

Post by bravetraveler »

nottorp wrote: post #186
bravetraveler wrote: post #79

Eh, I generally disagree - but not completely. Set SELinux to permissive for your personal systems at your own relative risk. Never disable it, you'll end up in a situation where nothing is labeled and relevant policy adjustments probably don't exist. Making re-enabling it later a nightmare. I'd argue it's particularly advantageous for desktops where untrusted software is a more common occurrence... and other control…

> I won't say it's easy, an employer of mine paid for two weeks of training that focused a lot specifically on this. ... and that's the problem. If something requires two weeks of training it's not hobbyist / small business friendly.

It's definitely a bit of a problem that it takes as much research to command as it does... but I don't believe it's so grand.

The distribution provided policies offer some sane defaults, smaller shops like this are less likely to be writing in-house software breaking the mold.

When they do run into a problem though it's bigger, because unless their people have been doing enterprise-y things, they don't really get the necessary exposure

Re: SELinux is unmanageable; just turn it off if it gets in your way

#400

Post by boilerupnc »

nrvn wrote: post #357
Frost1x wrote: post #265

Earlier quoted context omitted.

>My disagreement lies in the fact that you've described the problem, but are proposing that some software (SELinux) that fails to solve the problem is somehow good. My opinion is that there's a cultural and policy problem and you're simply not going to solve it with technology. I don't think SE Linux is bad, it just isn't the answer here. One (clearly not the only) main reasons people just run a bunch of software the…

> Unlike Civil Engineering, there's no licensing, no sorts of inspections, no oversight, liability is completepy waived in a 300 page agreement people just click through, etc. This! I have come to the same conclusion. If you want to construct a building you have to comply with multiple standards and industry regulations that serve as limitations and safeguards that follow your project from the initial idea up to (som…

>If you want to construct a building you have to comply with multiple standards and industry regulations that serve as limitations and safeguards that follow your project [...]

Also, don't forget that the laws of physics also weigh heavily on the minds of most engineering disciplines. Stuff has density, strength, thermal and kinetic properties that reflect omnipresent constraints on most decisions.

Post reply on HN