4 ms·
> The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand. There
by lazyier 4y ago
> The problem is not so much that selinux is too complicated (it is as complicated as it needs to be), but that we all run software we don't understand.
There are many many problems.
One of the biggest problem with SELinux is that it is trying to graft Mandatory Access Controls on a userland that is not designed for it.
Unix, frankly, is not designed for security. It is designed to get work done by writing a bunch of little buggy C programs that you string together in novel ways.
Security is something that was grafted on it. And it shows.
How many decades of security vulnerabilities have occurred because of a shared /tmp space? 40 years?
How do you graft access controls on a system designed with no access controls and potentially billions of combinations of programs, paths, and various other resources without breaking anything?
The answer is: You don't. You can't.
Were as you have a system designed for security, like Android, and literally hundreds of millions of fully SELinux-enabled fully locked down user-facing Linux devices are out there being used by people who haven't the faintest clue what "audit2allow" is and wouldn't understand it if you tried to explain it to them.
So it's less of an issue of "we all use software that we don't understand". SELinux is complicated enough that you can devote your life to trying to understand it and still fail to craft good rules for other people.
It's more of an issue of "Linux userland follows the basic Unix design from the 1970s which is kinda shit if your goal is security".
It is just bad design. Pure and simple. That is all there really is.
However there is a way out.
The way out is to give each process and each user their own little itty bitty special Unix environment where they can do whatever they want. And then you use strong divisions to keep them mostly unaware of each other. Use a default deny policy and only poke holes in it when required.
- freeopinion 4y agoMy android phone came without a calculator app. I recently realized this in a setting where I needed a calculator. I commented out loud about the lack of calculator and got some responses from the group I was in at the time. "Just download one from the app store," I was told. "But be prepared to grant it network access, file access, contacts access, camera access, and email privileges."
- lazyier 4y agoThe alternative, which is Linux, is to grant your calculator app the permissions to read and write to the same resources that your browser uses to store the password for your bank. Well "grant" is too strong of a word. "By default and there is nothing you can do about it unless you are exceptionally skilled" is more accurate. Also your calculator app can read your sudo password as you type it, which you do a dozen times a day to carry out complex and security sensitive tasks such as "Connect to printer to print out mom's recipe for brownies" and "restart bluetooth because it's buggy and you want to listen to spotify on your wireless headphones".
- vaylian 4y ago> Also your calculator app can read your sudo password as you type it True with X11. Fixed in Wayland.
- htkibar 4y agoWhich is still not the standard - probably will take at least a decade before we can even talk about this issue being fixed.
- johnny22 4y agostandard or not, it's already shipping by default in ubuntu and fedora except for when nvidia drivers are involved. The problems will be worked out.. one way or the other.
- yyyk 4y agoWayland fixed one problem, but there's no shortage of local privilege escalation bugs with which the calculator can still read the sudo password.
- vaylian 4y agoI want to learn more. Do you have some examples?
- afr0ck 4y agoa.k.a container.
- zamalek 4y agoYou really shouldn't rely on containers for this, unfortunately.