11–20 of 461 posts
Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/
It looks like the website is hosted by github pages, and the author didn't bother setting up SSL correctly.
After ~1 hour of work later, I came to the conclusion that I was going to disable SELinux. Another hour later, I disabled SELinux.
Much as the article mentions, there didn't seem to be much good help, especially w.r.t. learning what the incantations meant and how to use them properly outside of a narrow path. Similarly, I did not have any decent way of introspecting what was going on in there. The error messages were of the "you must google this to even have a remote chance of figuring out what it means at all."
I understand SELinux is probably designed for enterprise or organizational specialists and not for normies to touch. It just seemed a bit too extreme towards that end.
Apparmor is weak in all the same ways SELinux is weak, at least in terms of the ways that actually matter - that is to say, a kernel exploit is the simplest way out of either. But anyone can write an apparmor profile for any program in an hour, and if you actually know wtf you're doing you can build very strong profiles and trivially test and maintain them.
SELinux is "good" in that if you are building a system like Android, great, consumers get very tight policies for free, and SELinux is ultimately more expressive. But I think 99% of companies looking at an LSM MAC should probably roll apparmor.
Like others here, I had a similar experience. I setup a simple minecraft server on a SELinux secured OS. So far, so good. I wanted to setup a systemd service to startup and shutdown the minecraft server. After ~1 hour of work later, I came to the conclusion that I was going to disable SELinux. Another hour later, I disabled SELinux. Much as the article mentions, there didn't seem to be much good help, especially w.r.…
I like apparmor better. Set it up for high attack surface apps like browsers and vms.
> There’s nowhere on the system where you can view the policies and look up why something might or might not work. I always thought I had to be missing something with SELinux because this is what it seemed like to me and that can't be right. My impression is that the documentation for SELinux is extensive in all of the areas that aren't affecting you but it's really hard to nail down exactly what the policies are, wh…
It's doubly bad because most people running modern Linux run their apps in containers and don't need to understand it as they don't run into problems.
I'd this really is what gets the pageviews maybe someone should write a how-to on disabling all permissions because it's too hard.
Like others here, I had a similar experience. I setup a simple minecraft server on a SELinux secured OS. So far, so good. I wanted to setup a systemd service to startup and shutdown the minecraft server. After ~1 hour of work later, I came to the conclusion that I was going to disable SELinux. Another hour later, I disabled SELinux. Much as the article mentions, there didn't seem to be much good help, especially w.r.…
But that's hard work.
Guess it's another SELINUX=disabled