5 ms·

May I disagree partially, using this authors exact words? "... Unless you are a high risk target, spending almost any time beating SELinux into shape on your m

May I disagree partially, using this authors exact words? "... Unless you are a high risk target, spending almost any time beating SELinux into shape on your machine is a bad tradeoff and pretty much a waste ..." -- https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicMistake https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicM... If you are a high risk target, SELinux is a great option. Also, to refer to the partial disagreement, here is my exact feeling... "I'm a security aware sysadmin and yet yesterday I casually admitted that I made less-secure choices because the really secure option was too annoying and potentially inconvenient. In fact this is not the only case where I make this tradeoff, picking a less secure but more convenient option..." -- https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImportant https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImp...

apkostka 10y ago
I don't think you're disagreeing with the author. His statement was equivalent to "If you are not a high risk target, SELinux may be a bad choice". Since he used 'unless', I'm assuming his intent was the same as yours, "If you are a high risk target, SELinux is a great option."
- chucky_z 10y ago
  I was simply disagreeing with the title of "SELinux is beyond saving." SELinux doesn't need saving for those who have a strong use-case. There are some great lesser alternatives like AppArmor, grsec, TOMOYO, and AKARI if SELinux can't work for you. :)
  - viraptor 10y ago
    I did a quick review of available solutions some time ago, and what you're listing (apart from apparmor) is not an alternative. I'm assuming that if you're serious about security and capable of digging into complexity, you can just stay with selinux. So if you lack those: grsec (rbac) - distributions don't really include it apart from arch, gentoo, and other high-maintenance ones; default targetted configs not included tomoyo - easy to use for developers, but also often not available in default kernel; for normal users? start by explaining to them what syscalls and ioctls are; default targetted configs not included akari - you're on your own to compile it in, and the tools, and figure out which version you want, and ... (not simple process); default targetted configs not included apparmor - the only user-friendly alternative right now
  - tagrun 10y ago
    > There are some great lesser alternatives like AppArmor, grsec, Lesser? grsecurity is actually a far superior alternative to SELinux: https://grsecurity.net/compare.php https://grsecurity.net/compare.php It's unfortunate that their stable patches are no longer available publicly: https://grsecurity.net/announce.php https://grsecurity.net/announce.php
    - mcguire 10y ago
      Well, unless you've been blocked from getting it by what's-his-name.

apkostka 10y ago

I don't think you're disagreeing with the author. His statement was equivalent to "If you are not a high risk target, SELinux may be a bad choice". Since he used 'unless', I'm assuming his intent was the same as yours, "If you are a high risk target, SELinux is a great option."

chucky_z 10y ago
I was simply disagreeing with the title of "SELinux is beyond saving." SELinux doesn't need saving for those who have a strong use-case. There are some great lesser alternatives like AppArmor, grsec, TOMOYO, and AKARI if SELinux can't work for you. :)
- viraptor 10y ago
  I did a quick review of available solutions some time ago, and what you're listing (apart from apparmor) is not an alternative. I'm assuming that if you're serious about security and capable of digging into complexity, you can just stay with selinux. So if you lack those: grsec (rbac) - distributions don't really include it apart from arch, gentoo, and other high-maintenance ones; default targetted configs not included tomoyo - easy to use for developers, but also often not available in default kernel; for normal users? start by explaining to them what syscalls and ioctls are; default targetted configs not included akari - you're on your own to compile it in, and the tools, and figure out which version you want, and ... (not simple process); default targetted configs not included apparmor - the only user-friendly alternative right now
- tagrun 10y ago
  > There are some great lesser alternatives like AppArmor, grsec, Lesser? grsecurity is actually a far superior alternative to SELinux: https://grsecurity.net/compare.php https://grsecurity.net/compare.php It's unfortunate that their stable patches are no longer available publicly: https://grsecurity.net/announce.php https://grsecurity.net/announce.php
  - mcguire 10y ago
    Well, unless you've been blocked from getting it by what's-his-name.