• MNByChoice@midwest.social
    link
    fedilink
    arrow-up
    30
    arrow-down
    1
    ·
    1 year ago

    SELinux has long suffered from usability issues. Many commercial software packages require SELinux be disabled.

    Fix the docs, improve error messages, and create a GUI to improve usage.

    • joojmachine@lemmy.ml
      link
      fedilink
      arrow-up
      11
      arrow-down
      1
      ·
      1 year ago

      Hate to be the type of person to comment this, but patches more than welcome

      for real though, even a small contribution to the docs helps a ton

    • heartsofwar@lemmy.world
      link
      fedilink
      arrow-up
      11
      arrow-down
      1
      ·
      1 year ago

      Fix the docs, improve error messages, and create a GUI to improve usage.

      All of that is fine to do, but it won’t fix the issue of many commercial software requiring SELinux to be disabled; that will only be fixed by the software companies actually embracing and supporting SELinux by creating rule sets to allow their software to work with SELinux.

        • heartsofwar@lemmy.world
          link
          fedilink
          arrow-up
          10
          ·
          1 year ago

          lack of documentation isn’t the problem

          The problem is that companies don’t want to spend the time learning SELinux and supporting their software with SELinux. I’m an embedded Linux engineer and I see this all the time: companies are barely able to reach their product deadlines as-is; heaven forbid you add another requirement like SELinux to the mix.

          • Kazumara@feddit.de
            link
            fedilink
            arrow-up
            10
            ·
            1 year ago

            Recently a supplier of ours announced that we could finally host their shitty java app on Linux instead of paying fucking Oracle for Solaris. So we were eager to hear the requirements. It was RHEL 8.4 or something, a version that was already EOL at the time.

            They can’t even update their distros apparently.

    • eeleech@lemm.ee
      link
      fedilink
      arrow-up
      14
      ·
      1 year ago

      afaik yes, at least the arch kernel has selinux enabled, but you need to install the user space tools from the AUR.

    • Sh1nyM3t4l4ss@lemmy.world
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.

      I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.

      • Baut [she/her] auf.@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        8
        ·
        1 year ago

        Nitpick: it’s not that AppArmor isn’t as secure, it’s just that SELinux is more powerful. The security always is up to the profiles.
        If you were to compare the policies for Fedora and e.g. Debian, I would assume Fedora has better ones though lol

        • ladyanita22@lemmy.world
          link
          fedilink
          arrow-up
          3
          ·
          1 year ago

          For sure. I believe Debian’s AppArmor integration is a little bit of an afterthought and there’s lots of patches missing as Canonical likes to keep many improvements downstream.

      • yeah, same. I am currently on NixOS, but looking to move away because it’s lacking support any MAC. I really love NixOS and it’s declarative approach to things, but i can’t live with such a large security hole in my home Network.

        As soon as i find a Distro that has MAC and allows for at least semi-declarative configuration, i am switching. But being able to declare an env/dconf setting in my config and sync it across all devices is just too powerful

          • while i think that ansible is really cool, it’s not the same as Nix.

            correct me if i’m wrong, but afaik Ansible just modifies the current state of the System with a declarative configuration.

            Nix reverts your system back to install and then applies the configuration. The result is that in Nix if i remove something from the configuration.nix it is as if it never existed, whereas on Ansible it stays unless i manually run a task to uninstall it.

  • joojmachine@lemmy.ml
    link
    fedilink
    arrow-up
    13
    arrow-down
    1
    ·
    1 year ago

    Anyone even slightly interested in this, join!

    Seriously, I didn’t know jack about SELinux before joining the SIG and now I know a little less than jack about it (I tried confining my user and managed to be unable to login to my system)

      • joojmachine@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        You can just take a look at the links in the thread if you want to start testing, and can help report issues with your experiences in our Pagure repo, I still need to report mine to mnow if it’s a thing with GDM or if I just did something wrong

        • iamak@infosec.pub
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Okay. Also how beneficial would this be for my résumé if I’m trying to get into cyber security field?

  • msage@programming.dev
    link
    fedilink
    arrow-up
    9
    ·
    1 year ago

    A bit dated experience, but I wanted to make a ‘simple’ web app (nginx/fpm/psql) SELinux compatible in 2014.

    After reading the docs, it seemed I needed three layers of configuration just to make a policy. For two ports and two folders, that seemed way too complicated and absolutely not worth it.

  • raw@lemmy.ml
    link
    fedilink
    arrow-up
    8
    arrow-down
    1
    ·
    1 year ago

    I love it and it really makes my Desktop more secure. Switching it off, has lead to installing hostile or insecure software within months. When it was introduced, i felt controlled by it, but actually i saw, what a mess came out of it when i disabled that. Today i feel protected, out of eperience, even if i know shirt about how it exacly works, but i saw stupid software harming my system when it was disabled.