9 ms·

SELinux used to be one of those things you'd disable immediately upon installing a new RHEL/CentOS box for all the troubles it would cause. But default policies

by CrLf 10y ago

SELinux used to be one of those things you'd disable immediately upon installing a new RHEL/CentOS box for all the troubles it would cause. But default policies have evolved a lot, making this the wrong thing to do, for a few years now. But people still do it out of habit. If you ignore SELinux, it won't cause issues besides the ocasional need to run "restorecon" (which one gets into the habit of doing whenever an "access denied" error happens when permissions seem otherwise correct). But one problem still remains. SELinux is (very) complex and people (myself included) have a very hard time groking its base concepts. This limits adoption greatly, and I'm still to find a decent document that starts from the simple stuff and lets one build a mental concept of how it works before jumping into the more complicated (real-world) use cases.

w8rbt 10y ago
That's the issue with LSMs in general. They all work, but historically have been difficult to configure and impossible to maintain. That's changing. There used to be only one (SELinux), however, there's competition now from other LSMs. Smack, AppArmor, Tomoyo, etc. In part, that's why SELinux is improving. I've tried them all and settled on Tomoyo. The documentation is outstanding and it is (to me at least) the easiest LSM to reason about and configure. http://tomoyo.osdn.jp/ http://tomoyo.osdn.jp/
- jwildeboer 10y ago
  How up2date is tomoyo, though? The Changelog and updates on the front page seem to indicate that not much happened after 2015.
  - w8rbt 10y ago
    Last git commits in the Linux kernel were in 2016: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=40d273782ff16fe1a7445cc05c66a447dfea3433 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7560ef39dc0bfebba8f43766d8bb4c1ec5eb66fc https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/?id=refs%2Ftags%2Fv4.10-rc3&qt=author&q=tetsuo+handa https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....
- djsumdog 10y ago
  I've had to create apparmour profiles in the past. There is some good tooling, but it's still not trivial.
nailer 10y ago
I worked at Red Hat when SELinux was made mandatory. Every single customer was hit with 'avc denied'. Having to explain that avc was 'Access Vector Cache' and that 'Access Vector Cache' was part of SELinux, and trying to convince somebody to patch the messages to just say 'selinux denied' was nightmarish. That said: SELinux is one of the only things that can make shared Docker hosting (ie, where the containers are actually isolated from the host and each other) possible.
- nailer 10y ago
  Correcting self: 'made mandatory' -> 'enabled by default'
gtirloni 10y ago
> SELinux is (very) complex and people (myself included) have a very hard time groking its base concepts. I wonder what a clean slate OS design would look like. One that satisfied the same requirements without any concerns about backward compatibility with POSIX history. Does anyone know an OS with vaguely this goal?
- nicoburns 10y ago
  Microsoft's Midori project. It never saw the light of day, but there are some very interesting blog posts about it. The Redox project has some leanings in this direction.
- thegeomaster 10y ago
  How about Magenta [0] by Google, on top of Little Kernel (LK), a neat and modern microkernel design? (It's part of Google's work-in-progress complete OS named Fuchsia, which appeared briefly a while ago on tech news sites.) [0] https://fuchsia.googlesource.com/magenta https://fuchsia.googlesource.com/magenta
- nickpsecurity 10y ago
  Try the first two to be certified to high-assurance security: http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf The MLS model was too difficult to adapt to commercial use. Biba was good for stopping malware from overwriting files. They still preferred something more flexible. SCC then invented type enforcement in another high-assurance system: https://web.archive.org/web/20160311233659/http://www.cyberdefenseagency.com/publications/LOCK-An_Historical_Perspective.pdf https://web.archive.org/web/20160311233659/http://www.cyberd... Flask architecture was combining that tech with a microkernel. SCC, acquired by McAfee, added type enforcement to a BSD OS for their Sidewinder firewall. The next work by Mitre was proof-of-concept for OSS by adding it to Linux. That and a pile of incremental additions is called SELinux. I'm sure you'll find the LOCK design a lot cleaner as it was originally intended. ;) Also worth noting are the KeyKOS system (esp with KeySAFE), the capability-security machines, and one language-based mechanism: http://www.cis.upenn.edu/~KeyKOS/ http://www.cis.upenn.edu/~KeyKOS/ http://www.cs.washington.edu/homes/levy/capabook/index.html http://www.cs.washington.edu/homes/levy/capabook/index.html http://www4.cs.fau.de/Projects/JX/ http://www4.cs.fau.de/Projects/JX/ These collectively should keep you busy for a while. They're the kind of thing worth imitating or building on.
s_kilk 10y ago
The thing that kills it for me is that Fedora ships with broken default configuration. Install Fedora, reboot and log in. Chances are within minutes you'll start seeing "selinux denied" messages popping up, complaining about services, files and policies you've never heard of. How is anyone but a seasoned RHEL admin supposed to know what to do with that?
- cozzyd 10y ago
  This might have been true many years ago, but it certainly isn't true nowadays (at least... not on the Workstation spin, can't vouch for others).
  - s_kilk 10y ago
    I've had it happen to me in the last week, with Fedora 25 Workstation Edition, the latest and greatest. This seems like a good example of YMMV :)
    - op00to 10y ago
      Hope you filed a bug in this instance! Fedora makes this really easy to do.
      - Gracana 10y ago
        Sort of. I tried the latest workstation release recently and the installer was broken.. you need a bug tracker account to file a bug, so you need your browser to work, which is rough when your system doesn't.
      - s_kilk 10y ago
        I really should have, as I can't remember the specifics now. I'll try again in a VM and see if I can recreate the issue.
seanwilson 10y ago
Is there a good reason why it's hard to make SELinux easy to use?
- lisivka 10y ago
  Because parts of SELinux which are easy to use are already covered by POSIX.
reidrac 10y ago
You're absolutely right. The problem is that it really doesn't matter if it is amazing an works fine out of the box: people won't use it because SELinux is generally perceived as a technology that is too complicated and will break things if you don't disable it. At this point, very few people will bother to learn the few bits you need to know to troubleshoot and fix any issues you might encounter; and any benefits you get from using it are not worth the effort. I used Fedora from 12 to 21 (? I think) and always left SELinux enabled, and it just works. The few things that failed (I remember two issues, one with an experimental build of Chromium and another one with OpenVPN and certificates in $HOME), I submitted a bug report and created my own rule to workaround the issue. If I managed to run a desktop system with SELinux on, it should be possible (and potentially easier) to use it properly on a server.
- mhurron 10y ago
  > people won't use it because SELinux is generally perceived as a technology that is too complicated It's amazing how bad things have got with the majority of developers and admins that they refuse to learn things that are difficult and instead simply turn it off. It's not like all of them are too young to remember when nothing in their system was easy and they actually had to learn about what they were doing.
  - ethbro 10y ago
    A lot of this seems driven by IT departments cut to the bone or outsourced for minimum bid offshore. In either case, enterprise IT doesn't have the benefit of spending time fiddling that used to exist.
  - user5994461 10y ago
    There is a line between something being difficult and something causing any part of the system to randomly stop working with no explanation whatsoever except -if you're lucky- a single log line somewhere that will give no result when searched for on google.
  - skarap 10y ago
    Well - devs and admins spend the minimum effort required to reach their primary goal. And I believe most of the time that it is in line with their employer's policy. I'm too young to remember how it was in the old times (would be glad to hear a story or 2), but since my very first job, the internal policy (the real one - not the one presented to customer or auditors) has always been "scew firewall, selinux, principle of least privilege. Disable everything so it works right now and grant the dev team root access to the prod environments - they need it for an urgent customer issue!".
noinsight 10y ago
> I'm still to find a decent document that starts from the simple stuff and lets one build a mental concept of how it works before jumping into the more complicated (real-world) use cases. Well, there is this: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf https://people.redhat.com/duffy/selinux/selinux-coloring-boo... You can link it to repeat offenders who disable SELinux. (That might not be a good idea.)
- reitanqild 10y ago
  Read that a while ago and it didn't make it click for me. If I had just stumbled across it without a recommendation and without recognising the bame of the author I'd easly dismissed it as some kind of trolling but thats maybe just me. What I want is: 1. How to do tasks x, y and z (with explanations on why). 2. Complete documentation of all commands, settings files etc. Usually 2. is somewhat covered in the official docs and 1. is available in blog posts etc. Last I checked 1 was not covered in any way when it comes to SELinux. Making a coloring book out of it is nowhere on my list.
  - reitanqild 10y ago
    To late to edit but let me be perfectly clear that I am totally fine with people making coloring books etc, i just wish there was more how-to, but that might just be me.
- hobarrera 10y ago
  That sounds pretty cool, but where do rules come from? Suppose some author wrote some daemon. Is the packager responsible for writing the rules? It sounds like having packagers understand SELinux rules is a lot of responsibility, and if upstream is cross-platform, they might not care about such specific needs so as to provide it. Also, what happens if I write some small app? Do I need to write its rules? If it has no rules applied to it, then it's basically game over, because SELinux sounds like it works ONLY if it applies to all processes.
  - snuxoll 10y ago
toredash 10y ago
It doesn't help that cloud providers, e.g. DigitalOcean disable Selinux
- _jcwu 10y ago
  When I asked them about this and why they do not even tell the customer about this, they said it is so that they can reset the password when requested through the control panel.
  - cozzyd 10y ago
    Seems like they could write an SELinux rule to allow that behavior...
    - lisivka 10y ago
      Yeah, but it's basically same as `setenforce 0`.
      - vbernat 10y ago
        You need to be in the context that will allow the change of password. For example, if this is an agent, you need to be able to execute code in the agent. If this is from a DHCP hook in early boot, you need to execute in that hook. That's totally not equivalent to the use of "setenforce 0".
        lisivka 10y ago
        Yes, you are right. However, when I calculating risks and protection/price ratio, I see no difference. System with `setenforce 0` is equal to system with the rule for first two significant digit, because root password is most significant and risk of attack through webui is same and high too. Other risks are less significant than that and SELinux does not reduce them significantly.
        10y ago
hobarrera 10y ago
> But people still do it out of habit. It's very hard to come back from such a popular image of "100% broken and must be disabled immediately". Even if SELinux evolves to absolute perfection, the damage to its image is done, and that will take a long time to change, regrettably. It should not have been shipped so green. > If you ignore SELinux, it won't cause issues besides the ocasional need to run "restorecon" (which one gets into the habit of doing whenever an "access denied" error happens when permissions seem otherwise correct). Sound like it's still pretty broken, IMHO. I should never see an "access denied" error on a host I control, unless I misconfigured it. The truth is, the defaults MUST work on all common scenarios all of the time for these things to be successful. Otherwise, people will only see the downsides (and the upsides are rarely visible, and rarely outweigh the downsides).
- notriddle 10y ago
  > I should never see an "access denied" error on a host I control, unless I misconfigured it. What do you mean? Even stock UNIX will give a permission denied error if you try to run an executable without `chmod +x`-ing it or `rm -rf /boot` as a regular user.
deleted 10y ago
[deleted]
cesarb 10y ago
> If you ignore SELinux, it won't cause issues besides the ocasional need to run "restorecon" (which one gets into the habit of doing whenever an "access denied" error happens when permissions seem otherwise correct). You also have to put things in the correct place. For instance, your VPN certificates should be in $HOME/.cert so restorecon knows they should have the home_cert_t label.

by CrLf 10y ago

w8rbt 10y ago

That's the issue with LSMs in general. They all work, but historically have been difficult to configure and impossible to maintain. That's changing. There used to be only one (SELinux), however, there's competition now from other LSMs. Smack, AppArmor, Tomoyo, etc. In part, that's why SELinux is improving. I've tried them all and settled on Tomoyo. The documentation is outstanding and it is (to me at least) the easiest LSM to reason about and configure. http://tomoyo.osdn.jp/ http://tomoyo.osdn.jp/

jwildeboer 10y ago
How up2date is tomoyo, though? The Changelog and updates on the front page seem to indicate that not much happened after 2015.
- w8rbt 10y ago
  Last git commits in the Linux kernel were in 2016: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=40d273782ff16fe1a7445cc05c66a447dfea3433 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7560ef39dc0bfebba8f43766d8bb4c1ec5eb66fc https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/?id=refs%2Ftags%2Fv4.10-rc3&qt=author&q=tetsuo+handa https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....
djsumdog 10y ago
I've had to create apparmour profiles in the past. There is some good tooling, but it's still not trivial.

nailer 10y ago

I worked at Red Hat when SELinux was made mandatory. Every single customer was hit with 'avc denied'. Having to explain that avc was 'Access Vector Cache' and that 'Access Vector Cache' was part of SELinux, and trying to convince somebody to patch the messages to just say 'selinux denied' was nightmarish. That said: SELinux is one of the only things that can make shared Docker hosting (ie, where the containers are actually isolated from the host and each other) possible.

nailer 10y ago
Correcting self: 'made mandatory' -> 'enabled by default'

gtirloni 10y ago

> SELinux is (very) complex and people (myself included) have a very hard time groking its base concepts. I wonder what a clean slate OS design would look like. One that satisfied the same requirements without any concerns about backward compatibility with POSIX history. Does anyone know an OS with vaguely this goal?

nicoburns 10y ago
Microsoft's Midori project. It never saw the light of day, but there are some very interesting blog posts about it. The Redox project has some leanings in this direction.
thegeomaster 10y ago
How about Magenta [0] by Google, on top of Little Kernel (LK), a neat and modern microkernel design? (It's part of Google's work-in-progress complete OS named Fuchsia, which appeared briefly a while ago on tech news sites.) [0] https://fuchsia.googlesource.com/magenta https://fuchsia.googlesource.com/magenta
nickpsecurity 10y ago
Try the first two to be certified to high-assurance security: http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf The MLS model was too difficult to adapt to commercial use. Biba was good for stopping malware from overwriting files. They still preferred something more flexible. SCC then invented type enforcement in another high-assurance system: https://web.archive.org/web/20160311233659/http://www.cyberdefenseagency.com/publications/LOCK-An_Historical_Perspective.pdf https://web.archive.org/web/20160311233659/http://www.cyberd... Flask architecture was combining that tech with a microkernel. SCC, acquired by McAfee, added type enforcement to a BSD OS for their Sidewinder firewall. The next work by Mitre was proof-of-concept for OSS by adding it to Linux. That and a pile of incremental additions is called SELinux. I'm sure you'll find the LOCK design a lot cleaner as it was originally intended. ;) Also worth noting are the KeyKOS system (esp with KeySAFE), the capability-security machines, and one language-based mechanism: http://www.cis.upenn.edu/~KeyKOS/ http://www.cis.upenn.edu/~KeyKOS/ http://www.cs.washington.edu/homes/levy/capabook/index.html http://www.cs.washington.edu/homes/levy/capabook/index.html http://www4.cs.fau.de/Projects/JX/ http://www4.cs.fau.de/Projects/JX/ These collectively should keep you busy for a while. They're the kind of thing worth imitating or building on.

s_kilk 10y ago

The thing that kills it for me is that Fedora ships with broken default configuration. Install Fedora, reboot and log in. Chances are within minutes you'll start seeing "selinux denied" messages popping up, complaining about services, files and policies you've never heard of. How is anyone but a seasoned RHEL admin supposed to know what to do with that?

cozzyd 10y ago
This might have been true many years ago, but it certainly isn't true nowadays (at least... not on the Workstation spin, can't vouch for others).
- s_kilk 10y ago
  I've had it happen to me in the last week, with Fedora 25 Workstation Edition, the latest and greatest. This seems like a good example of YMMV :)
  - op00to 10y ago
    Hope you filed a bug in this instance! Fedora makes this really easy to do.
    - Gracana 10y ago
      Sort of. I tried the latest workstation release recently and the installer was broken.. you need a bug tracker account to file a bug, so you need your browser to work, which is rough when your system doesn't.
    - s_kilk 10y ago
      I really should have, as I can't remember the specifics now. I'll try again in a VM and see if I can recreate the issue.

seanwilson 10y ago

Is there a good reason why it's hard to make SELinux easy to use?

lisivka 10y ago
Because parts of SELinux which are easy to use are already covered by POSIX.

reidrac 10y ago

You're absolutely right. The problem is that it really doesn't matter if it is amazing an works fine out of the box: people won't use it because SELinux is generally perceived as a technology that is too complicated and will break things if you don't disable it. At this point, very few people will bother to learn the few bits you need to know to troubleshoot and fix any issues you might encounter; and any benefits you get from using it are not worth the effort. I used Fedora from 12 to 21 (? I think) and always left SELinux enabled, and it just works. The few things that failed (I remember two issues, one with an experimental build of Chromium and another one with OpenVPN and certificates in $HOME), I submitted a bug report and created my own rule to workaround the issue. If I managed to run a desktop system with SELinux on, it should be possible (and potentially easier) to use it properly on a server.

mhurron 10y ago
> people won't use it because SELinux is generally perceived as a technology that is too complicated It's amazing how bad things have got with the majority of developers and admins that they refuse to learn things that are difficult and instead simply turn it off. It's not like all of them are too young to remember when nothing in their system was easy and they actually had to learn about what they were doing.
- ethbro 10y ago
  A lot of this seems driven by IT departments cut to the bone or outsourced for minimum bid offshore. In either case, enterprise IT doesn't have the benefit of spending time fiddling that used to exist.
- user5994461 10y ago
  There is a line between something being difficult and something causing any part of the system to randomly stop working with no explanation whatsoever except -if you're lucky- a single log line somewhere that will give no result when searched for on google.
- skarap 10y ago
  Well - devs and admins spend the minimum effort required to reach their primary goal. And I believe most of the time that it is in line with their employer's policy. I'm too young to remember how it was in the old times (would be glad to hear a story or 2), but since my very first job, the internal policy (the real one - not the one presented to customer or auditors) has always been "scew firewall, selinux, principle of least privilege. Disable everything so it works right now and grant the dev team root access to the prod environments - they need it for an urgent customer issue!".

noinsight 10y ago

> I'm still to find a decent document that starts from the simple stuff and lets one build a mental concept of how it works before jumping into the more complicated (real-world) use cases. Well, there is this: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf https://people.redhat.com/duffy/selinux/selinux-coloring-boo... You can link it to repeat offenders who disable SELinux. (That might not be a good idea.)

reitanqild 10y ago
Read that a while ago and it didn't make it click for me. If I had just stumbled across it without a recommendation and without recognising the bame of the author I'd easly dismissed it as some kind of trolling but thats maybe just me. What I want is: 1. How to do tasks x, y and z (with explanations on why). 2. Complete documentation of all commands, settings files etc. Usually 2. is somewhat covered in the official docs and 1. is available in blog posts etc. Last I checked 1 was not covered in any way when it comes to SELinux. Making a coloring book out of it is nowhere on my list.
- reitanqild 10y ago
  To late to edit but let me be perfectly clear that I am totally fine with people making coloring books etc, i just wish there was more how-to, but that might just be me.
hobarrera 10y ago
That sounds pretty cool, but where do rules come from? Suppose some author wrote some daemon. Is the packager responsible for writing the rules? It sounds like having packagers understand SELinux rules is a lot of responsibility, and if upstream is cross-platform, they might not care about such specific needs so as to provide it. Also, what happens if I write some small app? Do I need to write its rules? If it has no rules applied to it, then it's basically game over, because SELinux sounds like it works ONLY if it applies to all processes.
- snuxoll 10y ago

toredash 10y ago

It doesn't help that cloud providers, e.g. DigitalOcean disable Selinux

_jcwu 10y ago
When I asked them about this and why they do not even tell the customer about this, they said it is so that they can reset the password when requested through the control panel.
- cozzyd 10y ago
  Seems like they could write an SELinux rule to allow that behavior...
  - lisivka 10y ago
    Yeah, but it's basically same as `setenforce 0`.
    - vbernat 10y ago
      You need to be in the context that will allow the change of password. For example, if this is an agent, you need to be able to execute code in the agent. If this is from a DHCP hook in early boot, you need to execute in that hook. That's totally not equivalent to the use of "setenforce 0".
      - lisivka 10y ago
        Yes, you are right. However, when I calculating risks and protection/price ratio, I see no difference. System with `setenforce 0` is equal to system with the rule for first two significant digit, because root password is most significant and risk of attack through webui is same and high too. Other risks are less significant than that and SELinux does not reduce them significantly.
        10y ago

hobarrera 10y ago

> But people still do it out of habit. It's very hard to come back from such a popular image of "100% broken and must be disabled immediately". Even if SELinux evolves to absolute perfection, the damage to its image is done, and that will take a long time to change, regrettably. It should not have been shipped so green. > If you ignore SELinux, it won't cause issues besides the ocasional need to run "restorecon" (which one gets into the habit of doing whenever an "access denied" error happens when permissions seem otherwise correct). Sound like it's still pretty broken, IMHO. I should never see an "access denied" error on a host I control, unless I misconfigured it. The truth is, the defaults MUST work on all common scenarios all of the time for these things to be successful. Otherwise, people will only see the downsides (and the upsides are rarely visible, and rarely outweigh the downsides).

notriddle 10y ago
> I should never see an "access denied" error on a host I control, unless I misconfigured it. What do you mean? Even stock UNIX will give a permission denied error if you try to run an executable without `chmod +x`-ing it or `rm -rf /boot` as a regular user.

deleted 10y ago

[deleted]

cesarb 10y ago

> If you ignore SELinux, it won't cause issues besides the ocasional need to run "restorecon" (which one gets into the habit of doing whenever an "access denied" error happens when permissions seem otherwise correct). You also have to put things in the correct place. For instance, your VPN certificates should be in $HOME/.cert so restorecon knows they should have the home_cert_t label.