4 ms·

> Yes, it has a learning curve, but it's worth it. That depends wholly on the circumstances in which those tradeoffs must be considered - additional security v

> Yes, it has a learning curve, but it's worth it. That depends wholly on the circumstances in which those tradeoffs must be considered - additional security vs ease of use. For people who don't work in banks and whatnot, the choice is probably rather simple to make, they'll just prefer to do whatever will let their code and software run as they want (be it permissive mode or disabling it). In those circumstances, SELinux can be little more than a nuisance and a roadblock, something that they didn't ask for and don't want or care for. When security is paramount, however, things are a bit different.

bayindirh 5y ago
> That depends wholly on the circumstances in which those tradeoffs must be considered - additional security vs ease of use. Of course, horses for courses. That's always implied, and I always keep that in mind. However, if there's a case which needs that level of security, telling "Nah, just disable it, we'll do containers instead" is wrong at best, very dangerous at worst. Also, I find having a background knowledge about these technologies beneficial. Having more tools under one's belt is never a disadvantage. It'll give you abilities in the best case, and provide you perspective in the worst.
- KronisLV 5y ago
  > However, if there's a case which needs that level of security, telling "Nah, just disable it, we'll do containers instead" is wrong at best, very dangerous at worst. Agreed, though partially. Those two technologies don't have to be mutually exclusive, though they sometimes are considered to be (e.g. working around the "system limitations" by using containers, when both could work in unison). There are cases where you'll want containers AND SELinux/AppArmor. There are cases where you'll want full blown VMs. And even in regards to containers, there are multiple classes of technologies to consider: LXC/LXD, jails (BSD), containerd/Podman, Firecracker/gVisor and so on. And also approaches, like rootless containers, user remapping etc. My point largely is that people will try to "get things done", everything that impedes them from doing that be damned (in their eyes)!
  - bayindirh 5y ago
    > Agreed, though partially. Those two technologies don't have to be mutually exclusive. No, of course. I only objected using containers instead of SELinux / AppArmor. I don't consider containers as "Security Layer" per se. The situation is just a side effect in my eyes, and if you need proper security, you need proper hardening. Solely and blindly trusting secondary effects for security is wrong and dangerous.

bayindirh 5y ago

> That depends wholly on the circumstances in which those tradeoffs must be considered - additional security vs ease of use. Of course, horses for courses. That's always implied, and I always keep that in mind. However, if there's a case which needs that level of security, telling "Nah, just disable it, we'll do containers instead" is wrong at best, very dangerous at worst. Also, I find having a background knowledge about these technologies beneficial. Having more tools under one's belt is never a disadvantage. It'll give you abilities in the best case, and provide you perspective in the worst.

KronisLV 5y ago
> However, if there's a case which needs that level of security, telling "Nah, just disable it, we'll do containers instead" is wrong at best, very dangerous at worst. Agreed, though partially. Those two technologies don't have to be mutually exclusive, though they sometimes are considered to be (e.g. working around the "system limitations" by using containers, when both could work in unison). There are cases where you'll want containers AND SELinux/AppArmor. There are cases where you'll want full blown VMs. And even in regards to containers, there are multiple classes of technologies to consider: LXC/LXD, jails (BSD), containerd/Podman, Firecracker/gVisor and so on. And also approaches, like rootless containers, user remapping etc. My point largely is that people will try to "get things done", everything that impedes them from doing that be damned (in their eyes)!
- bayindirh 5y ago
  > Agreed, though partially. Those two technologies don't have to be mutually exclusive. No, of course. I only objected using containers instead of SELinux / AppArmor. I don't consider containers as "Security Layer" per se. The situation is just a side effect in my eyes, and if you need proper security, you need proper hardening. Solely and blindly trusting secondary effects for security is wrong and dangerous.