5 ms·

How can I trust some opaque policy I cannot see? Not just trust that it is well intentioned not evil, (Oracle Linux?), but that it does what it says. And does w

by fargle 5y ago

How can I trust some opaque policy I cannot see? Not just trust that it is well intentioned not evil, (Oracle Linux?), but that it does what it says. And does what I need and that the opaque developers have correctly envisioned what I need to do. Security by obscurity is worse than none at all. Security by buying an "Enterprise" product is worse than that. What SELinux says is "real MAC security is super complicated, but don't worry we've taken care of all that for you, but you can't understand it or change anything". What I say is "easy peasy; if you access the machine you're root. Make sure that either it doesn't happen or it doesn't matter".

prmoustache 5y ago
> but you can't understand it or change anything" That is not true. SELinux is not hard to understand nor change. Most of the issues you might encounter are simply solved by changing a label in a file or directory. It is just not straightforward to debug and understand if you don't know it is there. I think most people who complain about it are multi distros/OS users and just only realize after losing precious time that an issue is selinux related.
- d2wa 5y ago
  But what am I, as the sysadmin, supposed to label things? Even if I know that I probably need to apply some labels, how do I find out what the policies are? What labels can interact with this program? You can turn to Google and find some incantations in a blog or forum post from ten years ago, but you can‘t easily see which labels a program is allowed to interact with or not. (If you even know to ask that question.)
  - dale_glass 5y ago
    Fedora comes with manpages. So for instance, say you want to place http pages outside of /var/www. Fedora comes with the selinux-policy-doc package, which gives you the httpd_selinux manpage: https://linux.die.net/man/8/httpd_selinux https://linux.die.net/man/8/httpd_selinux It's a tad dense, but in the Sharing Files you can find a section explaining what context is used and for what. You can also look at the existing context, eg: $ ls -laZ /var/www total 4 drwxr-xr-x. 4 root root system_u:object_r:httpd_sys_content_t:s0 33 mar 17 17:32 . drwxr-xr-x. 21 root root system_u:object_r:var_t:s0 4096 abr 18 10:57 .. drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_script_exec_t:s0 6 mar 17 17:32 cgi-bin drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_content_t:s0 6 mar 17 17:32 html And copy those for your own use.
  - chr15p 5y ago
    sesearch -A That shows the list of what labels are allowed to do what to which labels, so run ps -Z to get the label of your process and grep the sesearch output for it, and that will tell you what labels it's allowed to interact with and in what ways. selinux is generally pretty straightforward, but it has a reputation for being impenetrable which puts people of trying to learn it.
- fargle 5y ago
  really? I don't mean understand how to apply a new label. I mean understand what the policies are and how they work, be able to create new ones that apply to you, and verify that the ones given to you by the distro are correct for your use. You're saying this is not hard to understand: https://github.com/SELinuxProject/refpolicy/blob/master/policy/modules/admin/su.if https://github.com/SELinuxProject/refpolicy/blob/master/poli... ? Otherwise you are blindly applying some black box.

by fargle 5y ago

prmoustache 5y ago

> but you can't understand it or change anything" That is not true. SELinux is not hard to understand nor change. Most of the issues you might encounter are simply solved by changing a label in a file or directory. It is just not straightforward to debug and understand if you don't know it is there. I think most people who complain about it are multi distros/OS users and just only realize after losing precious time that an issue is selinux related.

d2wa 5y ago
But what am I, as the sysadmin, supposed to label things? Even if I know that I probably need to apply some labels, how do I find out what the policies are? What labels can interact with this program? You can turn to Google and find some incantations in a blog or forum post from ten years ago, but you can‘t easily see which labels a program is allowed to interact with or not. (If you even know to ask that question.)
- dale_glass 5y ago
  Fedora comes with manpages. So for instance, say you want to place http pages outside of /var/www. Fedora comes with the selinux-policy-doc package, which gives you the httpd_selinux manpage: https://linux.die.net/man/8/httpd_selinux https://linux.die.net/man/8/httpd_selinux It's a tad dense, but in the Sharing Files you can find a section explaining what context is used and for what. You can also look at the existing context, eg: $ ls -laZ /var/www total 4 drwxr-xr-x. 4 root root system_u:object_r:httpd_sys_content_t:s0 33 mar 17 17:32 . drwxr-xr-x. 21 root root system_u:object_r:var_t:s0 4096 abr 18 10:57 .. drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_script_exec_t:s0 6 mar 17 17:32 cgi-bin drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_content_t:s0 6 mar 17 17:32 html And copy those for your own use.
- chr15p 5y ago
  sesearch -A That shows the list of what labels are allowed to do what to which labels, so run ps -Z to get the label of your process and grep the sesearch output for it, and that will tell you what labels it's allowed to interact with and in what ways. selinux is generally pretty straightforward, but it has a reputation for being impenetrable which puts people of trying to learn it.
fargle 5y ago
really? I don't mean understand how to apply a new label. I mean understand what the policies are and how they work, be able to create new ones that apply to you, and verify that the ones given to you by the distro are correct for your use. You're saying this is not hard to understand: https://github.com/SELinuxProject/refpolicy/blob/master/policy/modules/admin/su.if https://github.com/SELinuxProject/refpolicy/blob/master/poli... ? Otherwise you are blindly applying some black box.