4 ms·

For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. However, it is working gr

by ansible 10y ago

For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. However, it is working great for Android. Where all apps are already sandboxed, and you don't have to worry about the user installing some app that will use a new system call, or try to touch random files on the system.

dice 10y ago
>For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. It's on by default in Fedora, has been for years. Most people never even know it's there.
SEJeff 10y ago
Funny, I've been running it on my laptop since Fedora 18 (current on 24 Beta). I might notice it maybe once every few months when a script or some software I'm futzing with tries to do something out of the ordinary: [jeff@omniscience ~]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 30 And yes, my nick is a throwback to Security Enhanced Linux, but when the next exploit for some common library or software comes out and I'm not affected due to SELinux, I'll smile. Can you say the same? A few quick examples I pulled up: https://blog.namei.org/2008/01/08/selinux-mitigates-remote-root-vulnerability-in-openpegasus/ https://blog.namei.org/2008/01/08/selinux-mitigates-remote-r... http://danwalsh.livejournal.com/10131.html http://danwalsh.livejournal.com/10131.html https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved_our_asses_xpost_rselinux/ https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved...

by ansible 10y ago

dice 10y ago

>For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it. It's on by default in Fedora, has been for years. Most people never even know it's there.

SEJeff 10y ago

Funny, I've been running it on my laptop since Fedora 18 (current on 24 Beta). I might notice it maybe once every few months when a script or some software I'm futzing with tries to do something out of the ordinary: [jeff@omniscience ~]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 30 And yes, my nick is a throwback to Security Enhanced Linux, but when the next exploit for some common library or software comes out and I'm not affected due to SELinux, I'll smile. Can you say the same? A few quick examples I pulled up: https://blog.namei.org/2008/01/08/selinux-mitigates-remote-root-vulnerability-in-openpegasus/ https://blog.namei.org/2008/01/08/selinux-mitigates-remote-r... http://danwalsh.livejournal.com/10131.html http://danwalsh.livejournal.com/10131.html https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved_our_asses_xpost_rselinux/ https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved...