5 ms·

HEADLINE SELinux installed by default DESCRIPTION Not sure what else to say...

• swiley 9y ago
  Maybe you would rather be running Redhat/Fedora? SELinux is one of the reasons I switched from Fedora to Debian.
• RVuRnvbM2e 9y ago
  Please no.. Apparmor is far more usable and functionally equivalent.
  • omginternets 9y ago
    Why not both? In the docker world, it would be a huge improvement.
    • bigon 9y ago
      The problem is that the docker policy is RHEL/Fedora centric and is not upstreamed in the refpolicy AFAIK
      • omginternets 9y ago
        We're touching on the limits of my understanding. Could you please elaborate?
        • bigon 9y ago
          SELinux is made of 3 things - The kernel doing the permissions check (called object manager) - The policy telling the kernel what is allowed or not - Some userspace tools and libraries to load and manipulate the policy and the state of SELinux The kernel and the userspace tools are almost the same across all distributions (Well Fedora/RHEL are carrying some patches). But for the policy it's a different story. RHEL/Fedora have a gigantic patch applied to the refpolicy (reference policy developed by the SELinux upstream). The policy allowing docker to work has not been upstreamed so it's not that easy for other distributions to use it
• bigon 9y ago
  This one is (partially) for me I guess. There is still some work needed for this to happen. The SELinux support should be added in the debian-installer and the policy needs to be generic enough to support several (basic?) usecases. The later is the difficult part, if the policy is not working for them, people will in most of the case just disable SELinux completely. Having a list of well tested usecases (LAMP, DNS,...) that we could support would maybe be a good start. Help is always welcome of course.
  • omginternets 9y ago
    How can I (familiar with linux, but not with the details of SELinux) help?