SELinux, Seccomp, Falco, and You: A Technical Discussion
1–10 of 26 posts
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#2I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm.
Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me.
After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them.
Is Selinux too hard? Or am I too incompetent? I really don't know.
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#3I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
Doesn't Android use SELinux in some shape/form now?
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#4I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
It's too hard. The fact that there was a culture of disabling it means that it was a total failure as a tool to secure the average server.
I think it's found its niche, finally, on Android because you can't really break an Android phone the way you can a linux server. You don't have root, the system doesn't change much, certainly not at the linux layer.
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#5I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
I think the main problem is that it's too much of a pain. Seems like whenever I configure DHCP, Bind, Postfix, Mysql, or other popular daemons, as soon as I get into a non-trivial configuration I start getting SElinux complaints.
Sure I can track them down and fix them, but there's only so much I'm willing to do. Seems like what SELinux should do is read the same config file the daemon does. That way when a distro makes changes to the filesystem layout that SElinux gets a free ride.
After all on a well run system there should be exactly one place for any single piece of important information, not two.
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#6I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
I think the main problem is that it's too much of a pain. Seems like whenever I configure DHCP, Bind, Postfix, Mysql, or other popular daemons, as soon as I get into a non-trivial configuration I start getting SElinux complaints. Sure I can track them down and fix them, but there's only so much I'm willing to do. Seems like what SELinux should do is read the same config file the daemon does. That way when a distro ma…
I've worked with SELinux professionally since 2002. The whole point of mandatory access controls is to NOT take the config file as gospel: rather, there are security goals we want to achieve even in the face of compromised daemons, or compromised app admins.
That means we do have to write some of these things down twice, because we want to have a fence and a lawn.
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#7Earlier quoted context omitted.
I think the main problem is that it's too much of a pain. Seems like whenever I configure DHCP, Bind, Postfix, Mysql, or other popular daemons, as soon as I get into a non-trivial configuration I start getting SElinux complaints. Sure I can track them down and fix them, but there's only so much I'm willing to do. Seems like what SELinux should do is read the same config file the daemon does. That way when a distro ma…
I've worked with SELinux professionally since 2002. The whole point of mandatory access controls is to NOT take the config file as gospel: rather, there are security goals we want to achieve even in the face of compromised daemons, or compromised app admins. That means we do have to write some of these things down twice, because we want to have a fence and a lawn.
Well in my experience the fence and lawn are so often based on different information that it's useless. Thus the common case is to turn off SELinux.
If you need the same info updated in two places you are doing it wrong. It could be moved up a level with a configuration management system. That way you could say Daemon X log in directory Y, and both places would get updated.
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#8I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
I've never been a fan of SELinux, in the context of what a "normal" GNU/Linux install looks like.
I've only just managed to put into words what my misgivings are after reading this article: it feels like anti-virus software. The trouble is, it's bolted-on security. It's trying to contain software which wasn't written to a strict boundary, to a strict boundary. So you start with a crappy boundary of existing insecure software. That doesn't really achieve much - it prevents expansion of each process' role, but it's already a huge boundary most have.
It makes more sense in the context of "fresh" Linux OS software, e.g Android, but that's exactly where a strict policy from the start, like seccomp, would have done the job.
I think the article misses that there's a third way: subdivided software written with strict roles and boundaries in the first place. Hence why I classify this as "anti-virus" - its enforcement only kicks in after compromise. Prevention is better.
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#9I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
Doesn't Android use SELinux in some shape/form now?
Yes. I posted an interesting technical article I found about it on here recently: https://ge0n0sis.github.io/posts/2015/12/exploring-androids-...
[Edit] this is specifically about the SELinux Kernel policy in Android
Re: SELinux, Seccomp, Falco, and You: A Technical Discussion
#10I fought for years against the culture of just turning off SELinux. I read every doc trying to Do The Right Thing when configuring the likes of vsftpd, samba or kvm. Didn't manage to keep them working jerks-free long enough without disabling it. Daemons always find a way to break with selinux on with me. After years, I just gave up. I feel sad about it, but just after install, I SELINUX=disabled them. Is Selinux too…
I've never been a fan of SELinux, in the context of what a "normal" GNU/Linux install looks like. I've only just managed to put into words what my misgivings are after reading this article: it feels like anti-virus software. The trouble is, it's bolted-on security. It's trying to contain software which wasn't written to a strict boundary, to a strict boundary. So you start with a crappy boundary of existing insecure…
t's trying to contain software which wasn't written to a strict boundary, to a strict boundary.
Exactly. That's why NSA, decades ago, wrote SELinux. It wasn't intended to be a security measure. It was intended to encourage development of user-space software which lived within strict security limits.
That never happened. The desire for loopholes ("must phone home", etc.) beat security restrictions. All a single-player game really needs is read access to its own assets, input from user input devices, output to graphics hardware and sound, and the ability to write in its own preferences/save directory. Try to find a commercial game which will run under such restrictions.