4 ms·

>I said built-in, you seem to have missed that part. I did not miss that part, you're just mistaken. >SELinux is not built-in(though it is for certain distrib

by YATA0 5y ago

>I said built-in, you seem to have missed that part. I did not miss that part, you're just mistaken. >SELinux is not built-in(though it is for certain distributions of Linux). Wrong. SELinux is 100% "built-in" to Linux. That's like saying btrfs or Wireguard are not "built-in" to Linux because certain distros may or may not have them compiled in. Nonetheless, SELinux is part of the kernel [0]. The rest of your dribble is a painful Gish gallop because you were decisively proven wrong. Mature up a bit and take the L. Fomenting about being proven wrong is against the Guidelines here. [0] https://lore.kernel.org/selinux/ https://lore.kernel.org/selinux/

zie 5y ago
I'm not trying to hate on SELinux, it's great stuff, for what it is. I'm not trying to hate on you either, though clearly you seem to have hatred towards me, which is just sad. I'm happy to accept that SELinux is now built-in to Linux, the kernel parts do indeed seem to be built in now, news to me, thanks for that. I don't follow Linux kernel stuff much anymore, I haven't contributed to Linux in over a decade. You seem to assume SELinux is the end-all be all of Linux security. It isn't. I recognize, based on your other comment, that you are fairly new to the field(a whole decade, go you!). Please open your mind and accept differing perspectives, it will do wonders for your ability to reason about security properly. HardenedBSD[0] essentially implements grsecurity for FreeBSD, plus FreeBSD has built-in capabilities with Capsicum[1], which is true capability based security, which is much different than SELinux's MAC stuff. If you don't believe me, go read the capsicum paper[1] and come to your own conclusions, it might prove enlightening. Also, see CheriBSD. :) 0: https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison 1: https://papers.freebsd.org/2010/rwatson-capsicum/ https://papers.freebsd.org/2010/rwatson-capsicum/ If you just want to continue hating on me, no reason to respond, we can go our separate ways. If you want to have a reasoned discussion about security, then I'm happy to continue.
- YATA0 5y ago
  >You seem to assume SELinux is the end-all be all of Linux security. Never said or implied anything of the sort. >I recognize, based on your other comment, that you are fairly new to the field(a whole decade, go you!). I've been implementing secure, hardened UNIX and Linux probably longer than you've been alive. I just specifically worked on DoD TS+ systems for a decade. The rest of your Gish gallop is nonsense. Linux also has capability based security ON TOP of all the other aspects of security, SELinux included. >If you want to have a reasoned discussion about security That's not possible with you. You instantly showed how little you know about security in general when you flouted your lack of SELinux knowledge, then you proceeded to Gish gallop and sealion because you've been called out. Stop it.
  - zie 5y ago
    If this is how you interact with people in the real world, I feel sorry for them. Grow up and interact with humanity better.
    - YATA0 5y ago
      >If this is how you interact with people in the real world, I feel sorry for them. IMAX-levle projection. The only one here you should feel sorry for is yourself. > Grow up and interact with humanity better. "no u". Grow up and take the L with grace.
    - skeptical1 5y ago
      Maybe he's just tired of people who offer ignorant opinions and argue based on conjecture and not actual knowledge.
      - YATA0 5y ago
        DING DING DING DING DING
  - ybloviator 5y ago
    And they say BSD users have attitude issues, lol.
    - YATA0 5y ago
      I also use BSD, AIX, Solaris, etc. As someone stated below, maybe I'm "just tired of people who offer ignorant opinions and argue based on conjecture and not actual knowledge."
tytso 5y ago
>>SELinux is not built-in(though it is for certain distributions of Linux). > >Wrong. SELinux is 100% "built-in" to Linux. That's like saying btrfs or ???>Wireguard are not "built-in" to Linux because certain distros may or may not >have them compiled in. Nonetheless, SELinux is part of the kernel [0]. It really depends on what you mean by "SELinux". The core kernel bits of SELinux, are of course, part of kernel by definition. However, SELinux is not really useful unless it comes with the SELinux policy definition which defines what applications do "normally". This work needs to be done by the Linux distribution, because without it, it's much like relationship between software and hardware. "Without the software, it's just a paperweight."
- YATA0 5y ago
  >It really depends on what you mean by "SELinux". Not it doesn't. Just like it doesn't "really depend" on what you mean by "btrfs". > However, SELinux is not really useful unless it comes with the SELinux policy definition which defines what applications do "normally". "However, btrts is not really useful unless it comes with the userland utilities to actually make and manipulate file systems" See how pedantic this is? Not only are you being pedantic, you're still wrong, fractally so. That is exactly operating system does, which is the topic of discussion. Linux OSs such as RHEL as an example. > This work needs to be done by the Linux distribution Which are defined as operating systems by CIS and STIG. This is a poor attempt at "DO YOU MEAN GNU/LINUX?". Stop it.
  - tytso 5y ago
    You can boot a system with a btrfs root file system without having the btrfs-progs installed. Good luck trying to use SELinux without having the policy installed; it's guaranteed to be non-functional. And given that the SELinux policy is distro-speicific, it's not like you can take a random Linux distribution, and enable SELinux and expect it to work. You enable SELinux on the boot command-line, but without the policy installed, it will be dead in the water. And configuring the SELinux policy is extremely non-trivial. It's several orders of magnitude more challenging than running, say, "mkfs.btrfs". >That is exactly operating system does, which is the topic of discussion. Linux >OSs such as RHEL as an example. If that's your definition of an OS, then there are plenty of Linux distributions --- aka, an "OS" by your definition --- that do *NOT* have SELinux built in, because they don't have an SELinux policy defined that will work with that distribution's system daemons. Therefore, by your definition SELinux is not "built in" to all versions of Linux (specifically, "distributions"). Q.E.D.
heavyset_go 5y ago
I agree with your point, but disagree with the way you said it. Also, it's drivel*, not dribble.

by YATA0 5y ago

zie 5y ago

I'm not trying to hate on SELinux, it's great stuff, for what it is. I'm not trying to hate on you either, though clearly you seem to have hatred towards me, which is just sad. I'm happy to accept that SELinux is now built-in to Linux, the kernel parts do indeed seem to be built in now, news to me, thanks for that. I don't follow Linux kernel stuff much anymore, I haven't contributed to Linux in over a decade. You seem to assume SELinux is the end-all be all of Linux security. It isn't. I recognize, based on your other comment, that you are fairly new to the field(a whole decade, go you!). Please open your mind and accept differing perspectives, it will do wonders for your ability to reason about security properly. HardenedBSD[0] essentially implements grsecurity for FreeBSD, plus FreeBSD has built-in capabilities with Capsicum[1], which is true capability based security, which is much different than SELinux's MAC stuff. If you don't believe me, go read the capsicum paper[1] and come to your own conclusions, it might prove enlightening. Also, see CheriBSD. :) 0: https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison 1: https://papers.freebsd.org/2010/rwatson-capsicum/ https://papers.freebsd.org/2010/rwatson-capsicum/ If you just want to continue hating on me, no reason to respond, we can go our separate ways. If you want to have a reasoned discussion about security, then I'm happy to continue.

YATA0 5y ago
>You seem to assume SELinux is the end-all be all of Linux security. Never said or implied anything of the sort. >I recognize, based on your other comment, that you are fairly new to the field(a whole decade, go you!). I've been implementing secure, hardened UNIX and Linux probably longer than you've been alive. I just specifically worked on DoD TS+ systems for a decade. The rest of your Gish gallop is nonsense. Linux also has capability based security ON TOP of all the other aspects of security, SELinux included. >If you want to have a reasoned discussion about security That's not possible with you. You instantly showed how little you know about security in general when you flouted your lack of SELinux knowledge, then you proceeded to Gish gallop and sealion because you've been called out. Stop it.
- zie 5y ago
  If this is how you interact with people in the real world, I feel sorry for them. Grow up and interact with humanity better.
  - YATA0 5y ago
    >If this is how you interact with people in the real world, I feel sorry for them. IMAX-levle projection. The only one here you should feel sorry for is yourself. > Grow up and interact with humanity better. "no u". Grow up and take the L with grace.
  - skeptical1 5y ago
    Maybe he's just tired of people who offer ignorant opinions and argue based on conjecture and not actual knowledge.
    - YATA0 5y ago
      DING DING DING DING DING
- ybloviator 5y ago
  And they say BSD users have attitude issues, lol.
  - YATA0 5y ago
    I also use BSD, AIX, Solaris, etc. As someone stated below, maybe I'm "just tired of people who offer ignorant opinions and argue based on conjecture and not actual knowledge."

tytso 5y ago

>>SELinux is not built-in(though it is for certain distributions of Linux). > >Wrong. SELinux is 100% "built-in" to Linux. That's like saying btrfs or ???>Wireguard are not "built-in" to Linux because certain distros may or may not >have them compiled in. Nonetheless, SELinux is part of the kernel [0]. It really depends on what you mean by "SELinux". The core kernel bits of SELinux, are of course, part of kernel by definition. However, SELinux is not really useful unless it comes with the SELinux policy definition which defines what applications do "normally". This work needs to be done by the Linux distribution, because without it, it's much like relationship between software and hardware. "Without the software, it's just a paperweight."

YATA0 5y ago
>It really depends on what you mean by "SELinux". Not it doesn't. Just like it doesn't "really depend" on what you mean by "btrfs". > However, SELinux is not really useful unless it comes with the SELinux policy definition which defines what applications do "normally". "However, btrts is not really useful unless it comes with the userland utilities to actually make and manipulate file systems" See how pedantic this is? Not only are you being pedantic, you're still wrong, fractally so. That is exactly operating system does, which is the topic of discussion. Linux OSs such as RHEL as an example. > This work needs to be done by the Linux distribution Which are defined as operating systems by CIS and STIG. This is a poor attempt at "DO YOU MEAN GNU/LINUX?". Stop it.
- tytso 5y ago
  You can boot a system with a btrfs root file system without having the btrfs-progs installed. Good luck trying to use SELinux without having the policy installed; it's guaranteed to be non-functional. And given that the SELinux policy is distro-speicific, it's not like you can take a random Linux distribution, and enable SELinux and expect it to work. You enable SELinux on the boot command-line, but without the policy installed, it will be dead in the water. And configuring the SELinux policy is extremely non-trivial. It's several orders of magnitude more challenging than running, say, "mkfs.btrfs". >That is exactly operating system does, which is the topic of discussion. Linux >OSs such as RHEL as an example. If that's your definition of an OS, then there are plenty of Linux distributions --- aka, an "OS" by your definition --- that do *NOT* have SELinux built in, because they don't have an SELinux policy defined that will work with that distribution's system daemons. Therefore, by your definition SELinux is not "built in" to all versions of Linux (specifically, "distributions"). Q.E.D.

heavyset_go 5y ago

I agree with your point, but disagree with the way you said it. Also, it's drivel*, not dribble.