3 ms·

I've switched to Fedora with version 26 (from Ubuntu and some dabbling with Manjaro) and really enjoy it. SELinux gave me a few headscratchers in the beginning

by DCKing 9y ago

I've switched to Fedora with version 26 (from Ubuntu and some dabbling with Manjaro) and really enjoy it. SELinux gave me a few headscratchers in the beginning but once you know how to deal with it it's great to have a distro that is both a great user experience and has some nice hardening/dont-shoot-yourself-in-the-foot features. The best thing for me about this release is better support for shared folders in Gnome Boxes (Ubuntu 17.10 and other distros with Gnome 3.26 have this too). This was the only thing holding Boxes back from firmly beating VirtualBox for desktop virtualization. Boxes is already a better user experience and uses superior libvirt/KVM tech for virtualization, but the shared folders UX was not up to par with VirtualBox before now.

jimmies 9y ago
I don't understand SELinux and I have not found a document that explains for the average Joe like me what it is for and why doesn't my qemu-libvirt work when it is enabled, which is the default. It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. So after scratching my head, I just turned it off altogether. Other than that, Fedora has been really rock solid, great distribution for me at home. I'm still using Ubuntu on my laptop and desktop at work, though. Ubuntu has been really good as well.
- DCKing 9y ago
  I am mostly on board with this, actually. The experience with machinectl and systemd-nspawn is also completely broken because there are no sane default SELinux rules for it. However in my experience so far, the defaults do not get in your way during regular usage. You typically only encounter such issues when you're also in the position to fix them. And I think in general it's a great idea to have default deny policies for containers and VMs. > So after scratching my head, I just turned it off altogether. Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com.
  - raller 9y ago
    > Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com. Uh, SELinux is next to useless on a typical desktop as all the applications which really concern you are running in the unconfined domain.
- unethical_ban 9y ago
  In a nutshell, SELinux controls how applications can interact with the filesystem, network, and OS. For example, It can control whether an application can bind to a privileged network port (below 1024) or whether an app can write to areas other than its default working directory. And it is not immediately obvious when it's causing issues, just because it's not used as strictly or at all in other distros. I was having trouble connecting to a service I started in Fedora, even though I disabled firewalld. Turns out it was SELinux.
  - dijit 9y ago
    It should be noted that there are booleans associated with selinux, the defaults have quite a few booleans that make it easy to allow commonly requested behaviour. `getsebool -a` and `setsebool` are your friends.
- deleted 9y ago
  [deleted]
- bubblethink 9y ago
  >I don't understand SELinux and I have not found a document that explains for the average Joe like me This could help: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf https://people.redhat.com/duffy/selinux/selinux-coloring-boo... >It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. That is not too hard to imagine. Basically, the rationale is that if qemu/libvirt can read your ROM file, it can probably read other files too, some of which might be sensitive. So the defaults are conservative. Unless your rom file is in a standard location where it expects, it won't read even if the permissions are 644. >So after scratching my head, I just turned it off altogether selinux is annoying, but it is worth persisting. Nowadays, most things work well. I think things are bit more stable in RHEL/CentOS than Fedora by definition. So maybe you can try that if you are getting too many selinux related problems.
jadbox 9y ago
What do you use Gnome Boxes for exactly.. is it for running a Windows instance?
- DCKing 9y ago
  Yes. When you install the VirtIO guest additions in Windows it works really great and uses memory ballooning to significantly reduce taxing of system memory.

by DCKing 9y ago

jimmies 9y ago

I don't understand SELinux and I have not found a document that explains for the average Joe like me what it is for and why doesn't my qemu-libvirt work when it is enabled, which is the default. It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. So after scratching my head, I just turned it off altogether. Other than that, Fedora has been really rock solid, great distribution for me at home. I'm still using Ubuntu on my laptop and desktop at work, though. Ubuntu has been really good as well.

DCKing 9y ago
I am mostly on board with this, actually. The experience with machinectl and systemd-nspawn is also completely broken because there are no sane default SELinux rules for it. However in my experience so far, the defaults do not get in your way during regular usage. You typically only encounter such issues when you're also in the position to fix them. And I think in general it's a great idea to have default deny policies for containers and VMs. > So after scratching my head, I just turned it off altogether. Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com.
- raller 9y ago
  > Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com. Uh, SELinux is next to useless on a typical desktop as all the applications which really concern you are running in the unconfined domain.
unethical_ban 9y ago
In a nutshell, SELinux controls how applications can interact with the filesystem, network, and OS. For example, It can control whether an application can bind to a privileged network port (below 1024) or whether an app can write to areas other than its default working directory. And it is not immediately obvious when it's causing issues, just because it's not used as strictly or at all in other distros. I was having trouble connecting to a service I started in Fedora, even though I disabled firewalld. Turns out it was SELinux.
- dijit 9y ago
  It should be noted that there are booleans associated with selinux, the defaults have quite a few booleans that make it easy to allow commonly requested behaviour. `getsebool -a` and `setsebool` are your friends.
deleted 9y ago
[deleted]
bubblethink 9y ago
>I don't understand SELinux and I have not found a document that explains for the average Joe like me This could help: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf https://people.redhat.com/duffy/selinux/selinux-coloring-boo... >It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. That is not too hard to imagine. Basically, the rationale is that if qemu/libvirt can read your ROM file, it can probably read other files too, some of which might be sensitive. So the defaults are conservative. Unless your rom file is in a standard location where it expects, it won't read even if the permissions are 644. >So after scratching my head, I just turned it off altogether selinux is annoying, but it is worth persisting. Nowadays, most things work well. I think things are bit more stable in RHEL/CentOS than Fedora by definition. So maybe you can try that if you are getting too many selinux related problems.

jadbox 9y ago

What do you use Gnome Boxes for exactly.. is it for running a Windows instance?

DCKing 9y ago
Yes. When you install the VirtIO guest additions in Windows it works really great and uses memory ballooning to significantly reduce taxing of system memory.