13 ms·

SELinux is beyond saving

137 points by fcambus 10y ago

vardump 10y ago
SELinux is still nice for hardening a safety critical server. But configuring it sure isn't fun.
chucky_z 10y ago
May I disagree partially, using this authors exact words? "... Unless you are a high risk target, spending almost any time beating SELinux into shape on your machine is a bad tradeoff and pretty much a waste ..." -- https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicMistake https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicM... If you are a high risk target, SELinux is a great option. Also, to refer to the partial disagreement, here is my exact feeling... "I'm a security aware sysadmin and yet yesterday I casually admitted that I made less-secure choices because the really secure option was too annoying and potentially inconvenient. In fact this is not the only case where I make this tradeoff, picking a less secure but more convenient option..." -- https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImportant https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImp...
- apkostka 10y ago
  I don't think you're disagreeing with the author. His statement was equivalent to "If you are not a high risk target, SELinux may be a bad choice". Since he used 'unless', I'm assuming his intent was the same as yours, "If you are a high risk target, SELinux is a great option."
  - chucky_z 10y ago
    I was simply disagreeing with the title of "SELinux is beyond saving." SELinux doesn't need saving for those who have a strong use-case. There are some great lesser alternatives like AppArmor, grsec, TOMOYO, and AKARI if SELinux can't work for you. :)
    - viraptor 10y ago
      I did a quick review of available solutions some time ago, and what you're listing (apart from apparmor) is not an alternative. I'm assuming that if you're serious about security and capable of digging into complexity, you can just stay with selinux. So if you lack those: grsec (rbac) - distributions don't really include it apart from arch, gentoo, and other high-maintenance ones; default targetted configs not included tomoyo - easy to use for developers, but also often not available in default kernel; for normal users? start by explaining to them what syscalls and ioctls are; default targetted configs not included akari - you're on your own to compile it in, and the tools, and figure out which version you want, and ... (not simple process); default targetted configs not included apparmor - the only user-friendly alternative right now
    - tagrun 10y ago
      > There are some great lesser alternatives like AppArmor, grsec, Lesser? grsecurity is actually a far superior alternative to SELinux: https://grsecurity.net/compare.php https://grsecurity.net/compare.php It's unfortunate that their stable patches are no longer available publicly: https://grsecurity.net/announce.php https://grsecurity.net/announce.php
      - mcguire 10y ago
        Well, unless you've been blocked from getting it by what's-his-name.
api 10y ago
Complexity is evil in security, and opt-in security generally doesn't work. SELinux is both complex and opt-in.
- ybx 10y ago
  You can make it enforce rules strictly over everything, rather than selectively enforce it on specific applications.
  - throwaway2048 10y ago
    no software is written with this in mind, so it wont work right without extensive babysitting (that nobody will do).
- andrey_utkin 10y ago
  SELinux is not opt-in in RedHat-based distros AFAIK.
greglindahl 10y ago
When CentOS 7 came out, I decided to make peace with all of the new stuff (systemd) and all of the old stuff I had been disabling (SELinux.) Turns out that doing crazy shit like letting users have their html files in ~/public_html/ requires a lot of SELinux configuration. procmail touching user directories? Yep. spamassassin? Why, yes. Maybe there's something I did wrong... I did read the docs. Also turns out that there isn't a tool which tells you what new rules are needed, relative to the existing configuration, for recent SELinux denies. Yeah, there are some tools to spit out a complete config file based on all logged problems, but not a diff, and I had already lost some of the early logs to logrotate n=4 by the time I realized I needed 'em. 111 lines of perl and 116 lines of SELinux rules later, I was in good shape. But REALLY? REALLY?
- protomyth 10y ago
  The truly scary part for me is that I might have missed one little thing that will come back and bite me. I have two RedHat boxes because a vendor requires them for software[1]. Luckily, neither needs to service internet clients. 1) the same vendor that feels a 752 Mbyte SQL file constitutes a patch
  - greglindahl 10y ago
    The server I'm talking about is a multi-user box used by a bunch of people for various toy activities. So what usually happens is someone will try to install something new and reasonable, it will fail, they will bitch at me, and then I'll run my scripts and update the selinux config. However, I do end up with surprising mystery issues. Just got a rule for logrotate needing to be able to reload some daemon... a year into this experiment. Wut?
    - protomyth 10y ago
      Thankfully, my servers are in full appliance mode and I don't have to worry about users (they are on the FreeBSD / ZFS box or one of the OpenBSD machines). I still worry since they have pretty valuable data on them.
- 10y ago
timthelion 10y ago
While I have nothing against SELinux, I feel that modern solutions using containers have made it almost irrelivant. And now some SE supporters are fighting back in the dirtiest way possible. https://opensource.com/business/14/7/docker-security-selinux https://opensource.com/business/14/7/docker-security-selinux Mr. Walsh makes all sorts of claims about things, such as devices, which are never exposed to the container, not being namespaced. It is very bad when someone who is respected and has qualifications goes and spreads lies and insinuations, just because their product is no longer relevant.
- tjohns 10y ago
  I thought that Docker containers were primarily intended for environment isolation, not for security? As I understood it, Docker relies on the kernel enforcing syscall namespaces for security... and that there's a (admittedly small) possibility of container breakouts via this route, because of the large surface area involved. Even the Docker devs have a whitepaper that recommends running Docker inside a VM when multi-tenancy is involved, as part of a defence-in-depth strategy: https://d3oypxn00j2a10.cloudfront.net/assets/img/Docker%20Security/WP_Intro_to_container_security_03.20.2015.pdf https://d3oypxn00j2a10.cloudfront.net/assets/img/Docker%20Se...
  - timthelion 10y ago
    The surface area for both technologies is the same: The kernel. Howerver, SELinux uses a complex set of rules for determining access rights, while containers use basic bindmounts.
  - cyphar 10y ago
    Docker uses SELinux, seccomp and apparmour as well as stock Linux capabilities (in conjunction with namespaces) to reduce the attack surface exposed to a container. There's nothing inherently insecure about containers (look at FreeBSD and Solaris). The issues you see with Linux "containers" are usually caused by leaky abstractions (namespaces that don't namespace the entire kernel) and insufficiently clever setup scripts. But it is getting better.
  - 10y ago
kkirsche 10y ago
Do people see this as something though which should be or needs to be replaced or is this just a it's dead? If the first, are there any projects I could contribute to or is a new project needed?
TimPrice 10y ago
If he calls himself a security aware sysadmin but he is somehow breaking his own beliefs for productivity/delivery reasons, I don't see much of an interest. Let him rant all he wants on his blog. Back to work.
waspleg 10y ago
I confess to disabling SELinux being one of the first things I always do on a new Linux box. It gets in the fucking way. A lot.
- matt_wulfeck 10y ago
  It works great on really mature platforms where the engineer has time to fine-tune and troubleshoot SELinux issues every time a change is made... But who the heck has the time for that now-a-days?
- andrey_utkin 10y ago
  I confess to using password "sex" everywhere and pinning it to my workstations' displays. Because making hard and secret passwords is hard.
tjohns 10y ago
It's worth noting that Android is using SELinux in recent versions for system hardening and as part of the sandboxing model. See: https://source.android.com/security/selinux/ https://source.android.com/security/selinux/ While I agree usability is suboptimal on servers, there are definitely environments it can excel in.
- notatoad 10y ago
  I don't think android is really a special case, SELinux is still hard. The only thing that makes android special is that google engineers have put in a lot of work to make SELinux work. It's a powerful tool, but if you want the benefits of SELinux it takes significant effort somewhere in the development chain.
- mtgx 10y ago
  I think Android is more of a special-case scenario as Google controls everything and it can just tell developers to conform with the more restricted environment in the new version of Android. For Android it also doesn't matter whether SELinux takes a lot of time to set-up right.
- SEJeff 10y ago
  Preventing many 0day or canned exploits isn't exactly suboptimal. It just requires better or more educated sysadmins.
ansible 10y ago
For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. However, it is working great for Android. Where all apps are already sandboxed, and you don't have to worry about the user installing some app that will use a new system call, or try to touch random files on the system.
- dice 10y ago
  >For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. It's on by default in Fedora, has been for years. Most people never even know it's there.
- SEJeff 10y ago
  Funny, I've been running it on my laptop since Fedora 18 (current on 24 Beta). I might notice it maybe once every few months when a script or some software I'm futzing with tries to do something out of the ordinary: [jeff@omniscience ~]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 30 And yes, my nick is a throwback to Security Enhanced Linux, but when the next exploit for some common library or software comes out and I'm not affected due to SELinux, I'll smile. Can you say the same? A few quick examples I pulled up: https://blog.namei.org/2008/01/08/selinux-mitigates-remote-root-vulnerability-in-openpegasus/ https://blog.namei.org/2008/01/08/selinux-mitigates-remote-r... http://danwalsh.livejournal.com/10131.html http://danwalsh.livejournal.com/10131.html https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved_our_asses_xpost_rselinux/ https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved...
matt_wulfeck 10y ago
SELinux is not not worth saving because security has been moving steadily into namespace separation (E.g., containers, virtual machines). Giving an application/user and entire trimmed down OS namespace reduces damage done from getting pwned significantly. Why use a system that protects processes from running alongside each other when I can just give them their own, fenced-in home?
- viraptor 10y ago
  No. No, no, no. Virtual machines - yes, to an extent. Containers - no. Containers still use the same kernel, have access to the same filesystems (in practice), same devices, same ioctls, etc. There can be a lot more separation done in the future, but right now, you definitely gain a lot by isolating your containers using selinux. Even with virtual machines, you want any breakout / external write vulnerability to be contained. That's why libvirt/kvm relies on selinux (or apparmor) for system protection and for cross-vm protection (https://libvirt.org/drvqemu.html#securityselinux https://libvirt.org/drvqemu.html#securityselinux)
  - matt_wulfeck 10y ago
    I realize the system is not perfect, but it's so much better than nothing, and significantly easier to use than virtualmachines/selinux. It's naive to dismiss something because it doesn't meet the goal of "100%" secure. In practice it gets you very close and takes almost no effort, no maintenance, no headache. Historically that kind of thing will win in the long run.
    - viraptor 10y ago
      I'm not arguing that VMs are not an improvement in many areas. They are a MASSIVE improvement and I'd love the unikernel apps to become more popular and push it even further. QubesOS also shows the power of safe virtualisation. But it doesn't mean "SELinux is not worth saving". Some kind of LSM (selinux/apparmor) is still a great safety net and protects us from an issue that VMs actually introduce. Once you break out of your VM, you have access not to a single host, but to a number of them in a way that no in-VM protection can stop or even detect. That's the reason we really need LSM protection. Not necessarily selinux, but something needs to be there.
sn 10y ago
Leaving selinux on would be more easy if the access denials were put in the primary system log and/or in dmesg and did not just go in the audit log. It takes too long to figure out what the problem is with selinux. That being said we leave it on in production, since with ansible we find the problem once and then incorporate the changes into our playbooks. I've used both apparmor and selinux and while it was pretty easy to figure out how to write a custom profile for apparmor, it's not easy to do the same for selinux. If a custom profile for selinux could be made as easy to write, that would help a lot.
- cmurf 10y ago
  At least on Fedora, for a few releases now, the audit messages appear in the journal, which is the primary system log.
w8rbt 10y ago
Russell Coker has done some work on SELinux. He's had a Linux box online since 2008 or so that users may ssh into as root. It's really amazing to see what SELinux can do. However, I agree that OpenBSD's focus on small and simple is the better approach. https://www.coker.com.au/selinux/ https://www.coker.com.au/selinux/ https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html
Endy 10y ago
And this kind of crap is why I use Windows.
- throwaway_xx9 10y ago
  Hahahaha! Good one.
- fallenshell 10y ago
  Really hoping that was sarcasm.
  - Endy 10y ago
    Nope. I'm greatly discomfited that my computer browses a UNIX/Linux backed internet - I'd rather stick to those sites backed by Windows.
- a3n 10y ago
  Ah yes, Windows, where you wake up one day and have a completely different OS.
  - hulahoof 10y ago
    That whole one time leading into 95 (b.")b
    - jessaustin 10y ago
      I detest Windows and touch it as rarely as possible, but this week I had to make an emergency trip to a client's office to re-share a folder after a server had "upgraded" itself from 7 to 10.
  - Endy 10y ago
    Funny, I'm still on Windows 7 - I know which "updates" are related to the Win10 upgrade thanks to the well-written Microsoft kdb articles (not sarcasm), and I disable them. No problem here.
- 10y ago
chris_wot 10y ago
I'm sure it's not intentional, but the author spends quite a lot of time telling me that the SELinux folks aren't listening or learning what the real issues are in security, but try as I might I all his links to his blog posts he doesn't actually state what they are! What are the key issues that SELinux needs to address?
- viraptor 10y ago
  One repeated many times is that it's complex enough that people default to turning it off. But it doesn't even come from users sometimes. Just google the following: installation instructions "setenforce 0" How many projects just went the lazy way? How many projects went out of their way to fix the issue the wrong way? Notice how nagios documentation first tells you how to disable selinux for the whole system and make it permanent. Only then as an alternative gives you two lines to make it work correctly instead. So what can SELinux folks address? Submit a change to every documentation in that list with instructions on how to make selinux work without issues. And make sure the alternative of "setenforce 0" has a warning that this will disable protection of your whole system rather than just this app.
educar 10y ago
Configuring SELinux reminded me of configuring email. My god, can simple systems be made more complex than this? I mean it's email and yet you have to really struggle with 100s of options to make sense of it all (and you do know sendmail has no public repo with a proper revision history right?). Apparmor, in contrast, is much easier to use (granted it has it's warts) but atleast they are trying to be user friendly instead of mathematically complete. /rant
- djsumdog 10y ago
  I remember going through hell trying to build an apparmour profile for an app at my last job (a Python app, which makes this a bit more complicated with interpreters, wrappers, external commands and such). I did get it built and the built in tools for aa are decent. I've never had to develop and SELinux profile. Now I don't ever want to.
  - educar 10y ago
    I feel I need to quality what I meant by 'much easier'. AA is exactly as you made it sound - actively asocial. Now imagine how SELinux is ;)
- Patrick_Devine 10y ago
  The cynic in me thinks this is a ploy for Red Hat to be able to sell more RHEL subscriptions/support. It just feels like there is no incentive to make things better.
noonespecial 10y ago
SELinux worked and worked well when you knew how to use it. (Learning how to use it was also reasonably hard.) Its primary problem was that its default behavior was stuff mysteriously failing on your system. This made it very hard for the uninitiated to get into it when stuff all over the web just recommended "turn off SELinux" as the first thing to do when something wasn't working right. It got a bad reputation as that quirky security thing that keeps stuff from working all the time.
mgbmtl 10y ago
The article (and the comments here) encouraged me install SELinux on one of my (Debian) VMs to see how it goes, and I'm now wondering why I didn't try it earlier.
nailer 10y ago
When SELinux first came out I was working as a training instructor for RH. Every single knowledgable sysadmin was kicked in the teeth by 'avc denied', one of the dumbest error messages to ever be created in Unix. 'avc' was Access Vector Cache. The Access Vector Cache was a component of SELinux. AVC denied meant selinux was denying access. But instead of printing 'selinux denied' - you know, like smb messages are for samba, and postfix messages are for postfix - the SELinux folks seemingly just wanted their audience to do a web search for 'avc denied'. It's a small picky thing, but rather than one person fix something, they made every admin do a piece of research instead. This is a pity: SELinux is one of the things that fixes the peering (aka 'Containers don't contain') issue with Docker.
kevin_thibedeau 10y ago
The post succeeds at saying nothing concrete about actual deficiencies in SELinux beyond "it gets in the way". Yes of course it does. That's what locked down systems do even if it's only to shoulder the blame for breaches on admins who disabled protections.
- drauh 10y ago
  My experience with it was on RHEL4.x some years ago, trying to install a bunch of stuff not from the official repos or EPEL. (I think it was Puppet, at the time.) Holy crap. It took me a week. It was more complex (or, almost equivalently, poorly documented) than the old AT&T Merlin PBX+voicemail system. The only thing I recall offhand was the hugeness of the namespace for roles (?) and actions (?). Every time I punched a hole to allow a specific thing to happen, something else blocked the action with cryptic logs in obscure places. I felt like a blind person, trying to find their way through a maze.
zanny 10y ago
If you are a security purist, why aren't you using grsec / pax / rbac in the first place? The general totem pole is grsec rbac is king > Apparmor is a destitute wannabe hacked together disaster that is still more usable than SELinux > Archlinux doesn't give a shit while Red Hat is off doing their own thing with SELinux with the NSA and Google.
cryptos 10y ago
What to use instead of SE Linux?

137 points by fcambus 10y ago

SELinux is still nice for hardening a safety critical server. But configuring it sure isn't fun.

May I disagree partially, using this authors exact words? "... Unless you are a high risk target, spending almost any time beating SELinux into shape on your machine is a bad tradeoff and pretty much a waste ..." -- https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicMistake https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicM... If you are a high risk target, SELinux is a great option. Also, to refer to the partial disagreement, here is my exact feeling... "I'm a security aware sysadmin and yet yesterday I casually admitted that I made less-secure choices because the really secure option was too annoying and potentially inconvenient. In fact this is not the only case where I make this tradeoff, picking a less secure but more convenient option..." -- https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImportant https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImp...

apkostka 10y ago
I don't think you're disagreeing with the author. His statement was equivalent to "If you are not a high risk target, SELinux may be a bad choice". Since he used 'unless', I'm assuming his intent was the same as yours, "If you are a high risk target, SELinux is a great option."
- chucky_z 10y ago
  I was simply disagreeing with the title of "SELinux is beyond saving." SELinux doesn't need saving for those who have a strong use-case. There are some great lesser alternatives like AppArmor, grsec, TOMOYO, and AKARI if SELinux can't work for you. :)
  - viraptor 10y ago
    I did a quick review of available solutions some time ago, and what you're listing (apart from apparmor) is not an alternative. I'm assuming that if you're serious about security and capable of digging into complexity, you can just stay with selinux. So if you lack those: grsec (rbac) - distributions don't really include it apart from arch, gentoo, and other high-maintenance ones; default targetted configs not included tomoyo - easy to use for developers, but also often not available in default kernel; for normal users? start by explaining to them what syscalls and ioctls are; default targetted configs not included akari - you're on your own to compile it in, and the tools, and figure out which version you want, and ... (not simple process); default targetted configs not included apparmor - the only user-friendly alternative right now
  - tagrun 10y ago
    > There are some great lesser alternatives like AppArmor, grsec, Lesser? grsecurity is actually a far superior alternative to SELinux: https://grsecurity.net/compare.php https://grsecurity.net/compare.php It's unfortunate that their stable patches are no longer available publicly: https://grsecurity.net/announce.php https://grsecurity.net/announce.php
    - mcguire 10y ago
      Well, unless you've been blocked from getting it by what's-his-name.

api 10y ago

Complexity is evil in security, and opt-in security generally doesn't work. SELinux is both complex and opt-in.

ybx 10y ago
You can make it enforce rules strictly over everything, rather than selectively enforce it on specific applications.
- throwaway2048 10y ago
  no software is written with this in mind, so it wont work right without extensive babysitting (that nobody will do).
andrey_utkin 10y ago
SELinux is not opt-in in RedHat-based distros AFAIK.

greglindahl 10y ago

When CentOS 7 came out, I decided to make peace with all of the new stuff (systemd) and all of the old stuff I had been disabling (SELinux.) Turns out that doing crazy shit like letting users have their html files in ~/public_html/ requires a lot of SELinux configuration. procmail touching user directories? Yep. spamassassin? Why, yes. Maybe there's something I did wrong... I did read the docs. Also turns out that there isn't a tool which tells you what new rules are needed, relative to the existing configuration, for recent SELinux denies. Yeah, there are some tools to spit out a complete config file based on all logged problems, but not a diff, and I had already lost some of the early logs to logrotate n=4 by the time I realized I needed 'em. 111 lines of perl and 116 lines of SELinux rules later, I was in good shape. But REALLY? REALLY?

protomyth 10y ago
The truly scary part for me is that I might have missed one little thing that will come back and bite me. I have two RedHat boxes because a vendor requires them for software[1]. Luckily, neither needs to service internet clients. 1) the same vendor that feels a 752 Mbyte SQL file constitutes a patch
- greglindahl 10y ago
  The server I'm talking about is a multi-user box used by a bunch of people for various toy activities. So what usually happens is someone will try to install something new and reasonable, it will fail, they will bitch at me, and then I'll run my scripts and update the selinux config. However, I do end up with surprising mystery issues. Just got a rule for logrotate needing to be able to reload some daemon... a year into this experiment. Wut?
  - protomyth 10y ago
    Thankfully, my servers are in full appliance mode and I don't have to worry about users (they are on the FreeBSD / ZFS box or one of the OpenBSD machines). I still worry since they have pretty valuable data on them.
10y ago

timthelion 10y ago

While I have nothing against SELinux, I feel that modern solutions using containers have made it almost irrelivant. And now some SE supporters are fighting back in the dirtiest way possible. https://opensource.com/business/14/7/docker-security-selinux https://opensource.com/business/14/7/docker-security-selinux Mr. Walsh makes all sorts of claims about things, such as devices, which are never exposed to the container, not being namespaced. It is very bad when someone who is respected and has qualifications goes and spreads lies and insinuations, just because their product is no longer relevant.

tjohns 10y ago
I thought that Docker containers were primarily intended for environment isolation, not for security? As I understood it, Docker relies on the kernel enforcing syscall namespaces for security... and that there's a (admittedly small) possibility of container breakouts via this route, because of the large surface area involved. Even the Docker devs have a whitepaper that recommends running Docker inside a VM when multi-tenancy is involved, as part of a defence-in-depth strategy: https://d3oypxn00j2a10.cloudfront.net/assets/img/Docker%20Security/WP_Intro_to_container_security_03.20.2015.pdf https://d3oypxn00j2a10.cloudfront.net/assets/img/Docker%20Se...
- timthelion 10y ago
  The surface area for both technologies is the same: The kernel. Howerver, SELinux uses a complex set of rules for determining access rights, while containers use basic bindmounts.
- cyphar 10y ago
  Docker uses SELinux, seccomp and apparmour as well as stock Linux capabilities (in conjunction with namespaces) to reduce the attack surface exposed to a container. There's nothing inherently insecure about containers (look at FreeBSD and Solaris). The issues you see with Linux "containers" are usually caused by leaky abstractions (namespaces that don't namespace the entire kernel) and insufficiently clever setup scripts. But it is getting better.
- 10y ago

kkirsche 10y ago

Do people see this as something though which should be or needs to be replaced or is this just a it's dead? If the first, are there any projects I could contribute to or is a new project needed?

TimPrice 10y ago

If he calls himself a security aware sysadmin but he is somehow breaking his own beliefs for productivity/delivery reasons, I don't see much of an interest. Let him rant all he wants on his blog. Back to work.

waspleg 10y ago

I confess to disabling SELinux being one of the first things I always do on a new Linux box. It gets in the fucking way. A lot.

matt_wulfeck 10y ago
It works great on really mature platforms where the engineer has time to fine-tune and troubleshoot SELinux issues every time a change is made... But who the heck has the time for that now-a-days?
andrey_utkin 10y ago
I confess to using password "sex" everywhere and pinning it to my workstations' displays. Because making hard and secret passwords is hard.

tjohns 10y ago

It's worth noting that Android is using SELinux in recent versions for system hardening and as part of the sandboxing model. See: https://source.android.com/security/selinux/ https://source.android.com/security/selinux/ While I agree usability is suboptimal on servers, there are definitely environments it can excel in.

notatoad 10y ago
I don't think android is really a special case, SELinux is still hard. The only thing that makes android special is that google engineers have put in a lot of work to make SELinux work. It's a powerful tool, but if you want the benefits of SELinux it takes significant effort somewhere in the development chain.
mtgx 10y ago
I think Android is more of a special-case scenario as Google controls everything and it can just tell developers to conform with the more restricted environment in the new version of Android. For Android it also doesn't matter whether SELinux takes a lot of time to set-up right.
SEJeff 10y ago
Preventing many 0day or canned exploits isn't exactly suboptimal. It just requires better or more educated sysadmins.

ansible 10y ago

For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. However, it is working great for Android. Where all apps are already sandboxed, and you don't have to worry about the user installing some app that will use a new system call, or try to touch random files on the system.

dice 10y ago
>For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. It's on by default in Fedora, has been for years. Most people never even know it's there.
SEJeff 10y ago
Funny, I've been running it on my laptop since Fedora 18 (current on 24 Beta). I might notice it maybe once every few months when a script or some software I'm futzing with tries to do something out of the ordinary: [jeff@omniscience ~]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 30 And yes, my nick is a throwback to Security Enhanced Linux, but when the next exploit for some common library or software comes out and I'm not affected due to SELinux, I'll smile. Can you say the same? A few quick examples I pulled up: https://blog.namei.org/2008/01/08/selinux-mitigates-remote-root-vulnerability-in-openpegasus/ https://blog.namei.org/2008/01/08/selinux-mitigates-remote-r... http://danwalsh.livejournal.com/10131.html http://danwalsh.livejournal.com/10131.html https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved_our_asses_xpost_rselinux/ https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved...

matt_wulfeck 10y ago

SELinux is not not worth saving because security has been moving steadily into namespace separation (E.g., containers, virtual machines). Giving an application/user and entire trimmed down OS namespace reduces damage done from getting pwned significantly. Why use a system that protects processes from running alongside each other when I can just give them their own, fenced-in home?

viraptor 10y ago
No. No, no, no. Virtual machines - yes, to an extent. Containers - no. Containers still use the same kernel, have access to the same filesystems (in practice), same devices, same ioctls, etc. There can be a lot more separation done in the future, but right now, you definitely gain a lot by isolating your containers using selinux. Even with virtual machines, you want any breakout / external write vulnerability to be contained. That's why libvirt/kvm relies on selinux (or apparmor) for system protection and for cross-vm protection (https://libvirt.org/drvqemu.html#securityselinux https://libvirt.org/drvqemu.html#securityselinux)
- matt_wulfeck 10y ago
  I realize the system is not perfect, but it's so much better than nothing, and significantly easier to use than virtualmachines/selinux. It's naive to dismiss something because it doesn't meet the goal of "100%" secure. In practice it gets you very close and takes almost no effort, no maintenance, no headache. Historically that kind of thing will win in the long run.
  - viraptor 10y ago
    I'm not arguing that VMs are not an improvement in many areas. They are a MASSIVE improvement and I'd love the unikernel apps to become more popular and push it even further. QubesOS also shows the power of safe virtualisation. But it doesn't mean "SELinux is not worth saving". Some kind of LSM (selinux/apparmor) is still a great safety net and protects us from an issue that VMs actually introduce. Once you break out of your VM, you have access not to a single host, but to a number of them in a way that no in-VM protection can stop or even detect. That's the reason we really need LSM protection. Not necessarily selinux, but something needs to be there.

sn 10y ago

Leaving selinux on would be more easy if the access denials were put in the primary system log and/or in dmesg and did not just go in the audit log. It takes too long to figure out what the problem is with selinux. That being said we leave it on in production, since with ansible we find the problem once and then incorporate the changes into our playbooks. I've used both apparmor and selinux and while it was pretty easy to figure out how to write a custom profile for apparmor, it's not easy to do the same for selinux. If a custom profile for selinux could be made as easy to write, that would help a lot.

cmurf 10y ago
At least on Fedora, for a few releases now, the audit messages appear in the journal, which is the primary system log.

w8rbt 10y ago

Russell Coker has done some work on SELinux. He's had a Linux box online since 2008 or so that users may ssh into as root. It's really amazing to see what SELinux can do. However, I agree that OpenBSD's focus on small and simple is the better approach. https://www.coker.com.au/selinux/ https://www.coker.com.au/selinux/ https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html

Endy 10y ago

And this kind of crap is why I use Windows.

throwaway_xx9 10y ago
Hahahaha! Good one.
fallenshell 10y ago
Really hoping that was sarcasm.
- Endy 10y ago
  Nope. I'm greatly discomfited that my computer browses a UNIX/Linux backed internet - I'd rather stick to those sites backed by Windows.
a3n 10y ago
Ah yes, Windows, where you wake up one day and have a completely different OS.
- hulahoof 10y ago
  That whole one time leading into 95 (b.")b
  - jessaustin 10y ago
    I detest Windows and touch it as rarely as possible, but this week I had to make an emergency trip to a client's office to re-share a folder after a server had "upgraded" itself from 7 to 10.
- Endy 10y ago
  Funny, I'm still on Windows 7 - I know which "updates" are related to the Win10 upgrade thanks to the well-written Microsoft kdb articles (not sarcasm), and I disable them. No problem here.
10y ago

chris_wot 10y ago

I'm sure it's not intentional, but the author spends quite a lot of time telling me that the SELinux folks aren't listening or learning what the real issues are in security, but try as I might I all his links to his blog posts he doesn't actually state what they are! What are the key issues that SELinux needs to address?

viraptor 10y ago
One repeated many times is that it's complex enough that people default to turning it off. But it doesn't even come from users sometimes. Just google the following: installation instructions "setenforce 0" How many projects just went the lazy way? How many projects went out of their way to fix the issue the wrong way? Notice how nagios documentation first tells you how to disable selinux for the whole system and make it permanent. Only then as an alternative gives you two lines to make it work correctly instead. So what can SELinux folks address? Submit a change to every documentation in that list with instructions on how to make selinux work without issues. And make sure the alternative of "setenforce 0" has a warning that this will disable protection of your whole system rather than just this app.

educar 10y ago

Configuring SELinux reminded me of configuring email. My god, can simple systems be made more complex than this? I mean it's email and yet you have to really struggle with 100s of options to make sense of it all (and you do know sendmail has no public repo with a proper revision history right?). Apparmor, in contrast, is much easier to use (granted it has it's warts) but atleast they are trying to be user friendly instead of mathematically complete. /rant

djsumdog 10y ago
I remember going through hell trying to build an apparmour profile for an app at my last job (a Python app, which makes this a bit more complicated with interpreters, wrappers, external commands and such). I did get it built and the built in tools for aa are decent. I've never had to develop and SELinux profile. Now I don't ever want to.
- educar 10y ago
  I feel I need to quality what I meant by 'much easier'. AA is exactly as you made it sound - actively asocial. Now imagine how SELinux is ;)
Patrick_Devine 10y ago
The cynic in me thinks this is a ploy for Red Hat to be able to sell more RHEL subscriptions/support. It just feels like there is no incentive to make things better.

noonespecial 10y ago

SELinux worked and worked well when you knew how to use it. (Learning how to use it was also reasonably hard.) Its primary problem was that its default behavior was stuff mysteriously failing on your system. This made it very hard for the uninitiated to get into it when stuff all over the web just recommended "turn off SELinux" as the first thing to do when something wasn't working right. It got a bad reputation as that quirky security thing that keeps stuff from working all the time.

mgbmtl 10y ago

The article (and the comments here) encouraged me install SELinux on one of my (Debian) VMs to see how it goes, and I'm now wondering why I didn't try it earlier.

nailer 10y ago

When SELinux first came out I was working as a training instructor for RH. Every single knowledgable sysadmin was kicked in the teeth by 'avc denied', one of the dumbest error messages to ever be created in Unix. 'avc' was Access Vector Cache. The Access Vector Cache was a component of SELinux. AVC denied meant selinux was denying access. But instead of printing 'selinux denied' - you know, like smb messages are for samba, and postfix messages are for postfix - the SELinux folks seemingly just wanted their audience to do a web search for 'avc denied'. It's a small picky thing, but rather than one person fix something, they made every admin do a piece of research instead. This is a pity: SELinux is one of the things that fixes the peering (aka 'Containers don't contain') issue with Docker.

kevin_thibedeau 10y ago

The post succeeds at saying nothing concrete about actual deficiencies in SELinux beyond "it gets in the way". Yes of course it does. That's what locked down systems do even if it's only to shoulder the blame for breaches on admins who disabled protections.

drauh 10y ago
My experience with it was on RHEL4.x some years ago, trying to install a bunch of stuff not from the official repos or EPEL. (I think it was Puppet, at the time.) Holy crap. It took me a week. It was more complex (or, almost equivalently, poorly documented) than the old AT&T Merlin PBX+voicemail system. The only thing I recall offhand was the hugeness of the namespace for roles (?) and actions (?). Every time I punched a hole to allow a specific thing to happen, something else blocked the action with cryptic logs in obscure places. I felt like a blind person, trying to find their way through a maze.

zanny 10y ago

If you are a security purist, why aren't you using grsec / pax / rbac in the first place? The general totem pole is grsec rbac is king > Apparmor is a destitute wannabe hacked together disaster that is still more usable than SELinux > Archlinux doesn't give a shit while Red Hat is off doing their own thing with SELinux with the NSA and Google.

cryptos 10y ago

What to use instead of SE Linux?