Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The SELinux coloring book [pdf]

people.redhat.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: The SELinux coloring book [pdf]

#41

Post by Dangeranger »

DanBC wrote: post #38
Dangeranger wrote: post #27

This trend of using illustration to explain complex topics is really wonderful. I know that people may criticize it as childish, but I find it helpful and enlightening. The illustrations that I've found most amazing and well done are created by people like: Lin Clark ( https://code-cartoons.com/ ) Julia Evans ( http://jvns.ca/zines/ ) Linda Liukas ( http://www.helloruby.com/ ) Amy Wibowo ( https://shop.bubblesort.io/…

It's a long running tradition, especially in medical education. Here's an edition from 17 years ago: https://www.amazon.co.uk/Human-Brain-Coloring-Book-Concepts/...

Excellent example. I love the visual kinesthetic combination of these books and wonder if there has been studies on it's effect on learning.

Re: The SELinux coloring book [pdf]

#42

Post by tene »

pricechild wrote: post #23
Moogs wrote: post #7

Earlier quoted context omitted.

If you're having issues with selinux run: sealert -a /var/log/audit/audit.log Most of the time, that will give you a detailed description of what's going wrong and tell you the command to fix it. Completely changed my opinion on selinux when I learned it. Also, the SELinux For Mere Mortals[1] talk is a great introduction. [1] https://www.youtube.com/watch?v=MxjenQ31b70&t=1s

It's nice... but the suggestions are often terrible when they could be fixed properly with a bool or changing the context of a directory. I sat the RHCE course/exam recently and the Red Hat trainer dealt with this in... amusing... ways. Unfortunately, fixing things properly requires knowledge, if only of where to find the information. Thinking solely about file contexts, it's not easy to for example search them. e.g.…

I personally feel like the included man pages on RH distros for selinux discussion on specific topics are quite good. You can see the full list of these by searching your man database with: man -k _selinux

In this specific case, you're looking for samba_selinux. It's not perfectly written, but it should at least cover all the relevant information: (https://linux.die.net/man/8/samba_selinux). You mentioned looking for the read/write share label, and that's specifically discussed, and described with examples.

You can also use sesearch to query your selinux policy for more information about anything mentioned in that man page. For example, to understand the implications of setting samba_enable_home_dirs you can run `sesearch -A -b samba_enable_home_dirs`. You can run similar queries for file types, process types, port types, etc. If you really want a list of every type relevant to samba, you can run: `sesearch -A -s smbd_t`. If you wanted to use sesearch to find everything smbd_t can write to, as an alternate method of discovering public_content_rw_t, you can filter that, like: `sesearch -A -s smbd_t -p write -d -c file -C`. This will also show you that the public_content_rw_t rule is conditional on the smbd_anon_write boolean.

I used to teach RHCE courses and exams; I'm curious about the amusing ways of dealing with selinux you encountered.

Re: The SELinux coloring book [pdf]

#43

Post by djsumdog »

krylon wrote: post #4

SELinux always makes me feel like I'm a complete idiot (the worst thing about that is that I could be an idiot and not know it or refuse to acknowledge it). So, maybe this introduction will make it a little more accessible.

AppArmor took some time to understand, but it wasn't too bad. I've written AppArmor profiles for in-house apps. I realize AppArmor isn't as powerful as SELinux, but I do find it easier to understand.

I feel like having to worry about complex SELinux configuration isn't going to matter as much for people who start to use containers. Most distributions have SELinux profiles for docker that work, and containers provide a decent level of isolation.

They're not as good as full VMs, and a kernel exploit can still break out of a container, but if you're running all your own in house/trusted code on your container system, it seems like a pretty good trade-off for isolation/security.

Re: The SELinux coloring book [pdf]

#44

Post by poojasgada »

Dangeranger wrote: post #27

This trend of using illustration to explain complex topics is really wonderful. I know that people may criticize it as childish, but I find it helpful and enlightening. The illustrations that I've found most amazing and well done are created by people like: Lin Clark ( https://code-cartoons.com/ ) Julia Evans ( http://jvns.ca/zines/ ) Linda Liukas ( http://www.helloruby.com/ ) Amy Wibowo ( https://shop.bubblesort.io/…

The discussion is about selinux, and not gender.

Re: The SELinux coloring book [pdf]

#45

Post by lima »

pricechild wrote: post #23
Moogs wrote: post #7

Earlier quoted context omitted.

If you're having issues with selinux run: sealert -a /var/log/audit/audit.log Most of the time, that will give you a detailed description of what's going wrong and tell you the command to fix it. Completely changed my opinion on selinux when I learned it. Also, the SELinux For Mere Mortals[1] talk is a great introduction. [1] https://www.youtube.com/watch?v=MxjenQ31b70&t=1s

It's nice... but the suggestions are often terrible when they could be fixed properly with a bool or changing the context of a directory. I sat the RHCE course/exam recently and the Red Hat trainer dealt with this in... amusing... ways. Unfortunately, fixing things properly requires knowledge, if only of where to find the information. Thinking solely about file contexts, it's not easy to for example search them. e.g.…

I found it to be extremely helpful to check out the Fedora SELinux repositories. They're an excellent reference and full of good examples.

https://github.com/fedora-selinux/selinux-policy

Re: The SELinux coloring book [pdf]

#46

Post by munificent »

jamiethompson wrote: post #2

As a colouring book, it's not great.

The writing is all messed up too. :(

Very first sentence:

> The SELinux primary model or enforcement is called type enforcement.

"or" should be "of" or "for". I'm not sure which, because it doesn't even tell you what enforcement means.

First page:

> Imagine a system where we define types on objects like cats and dogs.

"On" isn't a preposition you usually use with "type". You can say things have a type, or are a type, but "define a type on" is a unfamiliar construction.

> A cat and dog are process types.

I'm confused. Do they have types defined on them, or are they the types? Earlier, it said they are objects, now they are process types?

> We have a class of objects that they want to interact with which we call food. And I want to add types to the food, cat_chow and dog_chow.

Using "they" to refer to a noun from the previous page is a little confusing. "food" should be quoted. You can start a sentence with "And", but it feels gratuitous here since the previous sentence is short.

> As a policy writer, I would say that a dog has permission to eat dog_chow write this rule in policy, as shown below.

What happened between "dog_chow" and "write" here? The latter half looks like a random fragment of text. What is a "policy writer"?

> food and a cat has permission to eat cat_chow food. In SELinux we would

We would what?

Re: The SELinux coloring book [pdf]

#47

Post by SloopJon »

munificent wrote: post #46
jamiethompson wrote: post #2

As a colouring book, it's not great.

The writing is all messed up too. :( Very first sentence: > The SELinux primary model or enforcement is called type enforcement. "or" should be "of" or "for". I'm not sure which, because it doesn't even tell you what enforcement means. First page: > Imagine a system where we define types on objects like cats and dogs. "On" isn't a preposition you usually use with "type". You can say things have a type, or are a type,…

The last two sentences that you complain about are on a two-page spread: "As a policy writer, I would say that a dog has permission to eat dog_chow food and a cat has permission to eat cat_chow food. In SELinux we would write this rule in policy, as shown below."

Re: The SELinux coloring book [pdf]

#48

Post by NoGravitas »

blockoperation wrote: post #39
NoGravitas wrote: post #35

Earlier quoted context omitted.

That "show me all contexts related to samba" is something I'm really missing. I worked one weekend on getting NextCloud to play nicely with SELinux and Apache on Fedora 25 without any dirty tricks, and one thing that would really have come in handy was an accurate list of all the labels related to Apache. The only comprehensive lists I could find online were out-of-date, and the only things that were up to date were…

sesearch is one way of doing it, for example: $ sesearch -A -s some_app_t -c file -p read -p write allow some_app_t some_type_t:file { read write }; allow some_app_t some_other_type_t:file { read write }; allow some_attribute_of_some_app_t yet_another_type_t:file { read write }; Or, say you want to do the opposite – you know the label, and want to find all domains that can read and write it: $ sesearch -A -t some_typ…

I had no idea this existed. Thank you.

Re: The SELinux coloring book [pdf]

#49

Post by aw3c2 »

Dangeranger wrote: post #27

This trend of using illustration to explain complex topics is really wonderful. I know that people may criticize it as childish, but I find it helpful and enlightening. The illustrations that I've found most amazing and well done are created by people like: Lin Clark ( https://code-cartoons.com/ ) Julia Evans ( http://jvns.ca/zines/ ) Linda Liukas ( http://www.helloruby.com/ ) Amy Wibowo ( https://shop.bubblesort.io/…

Maybe men don't feel comfortable publishing book in styles that others perceive as women's territory.

Re: The SELinux coloring book [pdf]

#50

Post by twic »

Dangeranger wrote: post #27

This trend of using illustration to explain complex topics is really wonderful. I know that people may criticize it as childish, but I find it helpful and enlightening. The illustrations that I've found most amazing and well done are created by people like: Lin Clark ( https://code-cartoons.com/ ) Julia Evans ( http://jvns.ca/zines/ ) Linda Liukas ( http://www.helloruby.com/ ) Amy Wibowo ( https://shop.bubblesort.io/…

I wonder if it's because a colouring book is not a Serious Adult thing, and women have - or allow themselves - a bit more wiggle room to not be Serious Adults all the time.
Post reply on HN