3 ms·

I don't understand SELinux and I have not found a document that explains for the average Joe like me what it is for and why doesn't my qemu-libvirt work when it

I don't understand SELinux and I have not found a document that explains for the average Joe like me what it is for and why doesn't my qemu-libvirt work when it is enabled, which is the default. It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. So after scratching my head, I just turned it off altogether. Other than that, Fedora has been really rock solid, great distribution for me at home. I'm still using Ubuntu on my laptop and desktop at work, though. Ubuntu has been really good as well.

DCKing 9y ago
I am mostly on board with this, actually. The experience with machinectl and systemd-nspawn is also completely broken because there are no sane default SELinux rules for it. However in my experience so far, the defaults do not get in your way during regular usage. You typically only encounter such issues when you're also in the position to fix them. And I think in general it's a great idea to have default deny policies for containers and VMs. > So after scratching my head, I just turned it off altogether. Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com.
- raller 9y ago
  > Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com. Uh, SELinux is next to useless on a typical desktop as all the applications which really concern you are running in the unconfined domain.
unethical_ban 9y ago
In a nutshell, SELinux controls how applications can interact with the filesystem, network, and OS. For example, It can control whether an application can bind to a privileged network port (below 1024) or whether an app can write to areas other than its default working directory. And it is not immediately obvious when it's causing issues, just because it's not used as strictly or at all in other distros. I was having trouble connecting to a service I started in Fedora, even though I disabled firewalld. Turns out it was SELinux.
- dijit 9y ago
  It should be noted that there are booleans associated with selinux, the defaults have quite a few booleans that make it easy to allow commonly requested behaviour. `getsebool -a` and `setsebool` are your friends.
deleted 9y ago
[deleted]
bubblethink 9y ago
>I don't understand SELinux and I have not found a document that explains for the average Joe like me This could help: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf https://people.redhat.com/duffy/selinux/selinux-coloring-boo... >It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. That is not too hard to imagine. Basically, the rationale is that if qemu/libvirt can read your ROM file, it can probably read other files too, some of which might be sensitive. So the defaults are conservative. Unless your rom file is in a standard location where it expects, it won't read even if the permissions are 644. >So after scratching my head, I just turned it off altogether selinux is annoying, but it is worth persisting. Nowadays, most things work well. I think things are bit more stable in RHEL/CentOS than Fedora by definition. So maybe you can try that if you are getting too many selinux related problems.

DCKing 9y ago

I am mostly on board with this, actually. The experience with machinectl and systemd-nspawn is also completely broken because there are no sane default SELinux rules for it. However in my experience so far, the defaults do not get in your way during regular usage. You typically only encounter such issues when you're also in the position to fix them. And I think in general it's a great idea to have default deny policies for containers and VMs. > So after scratching my head, I just turned it off altogether. Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com.

raller 9y ago
> Please don't do this. It's not worth disabling an entire security system if you can just spend some time to figure out a command to make the system work for you. Fedora even has gui tools that notify you when you encounter an SELinux issue. See stopdisablingselinux.com. Uh, SELinux is next to useless on a typical desktop as all the applications which really concern you are running in the unconfined domain.

unethical_ban 9y ago

In a nutshell, SELinux controls how applications can interact with the filesystem, network, and OS. For example, It can control whether an application can bind to a privileged network port (below 1024) or whether an app can write to areas other than its default working directory. And it is not immediately obvious when it's causing issues, just because it's not used as strictly or at all in other distros. I was having trouble connecting to a service I started in Fedora, even though I disabled firewalld. Turns out it was SELinux.

dijit 9y ago
It should be noted that there are booleans associated with selinux, the defaults have quite a few booleans that make it easy to allow commonly requested behaviour. `getsebool -a` and `setsebool` are your friends.

deleted 9y ago

[deleted]

bubblethink 9y ago

>I don't understand SELinux and I have not found a document that explains for the average Joe like me This could help: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf https://people.redhat.com/duffy/selinux/selinux-coloring-boo... >It took me two nights to figure out that SELinux prevents qemu-libvirt to read certain ROM files that I need. That is not too hard to imagine. Basically, the rationale is that if qemu/libvirt can read your ROM file, it can probably read other files too, some of which might be sensitive. So the defaults are conservative. Unless your rom file is in a standard location where it expects, it won't read even if the permissions are 644. >So after scratching my head, I just turned it off altogether selinux is annoying, but it is worth persisting. Nowadays, most things work well. I think things are bit more stable in RHEL/CentOS than Fedora by definition. So maybe you can try that if you are getting too many selinux related problems.