4 ms·

> also have a useless distro, just like using selinux to make the whole thing immutable. Absolute nonsense. > The difference is you won't have to spent 2 year

> also have a useless distro, just like using selinux to make the whole thing immutable. Absolute nonsense. > The difference is you won't have to spent 2 years learning a custom policy language. If you had bothered to spend maybe 2 months bothering to learn this tech that's been around for almost 20 years, you wouldn't have to use specialty distros to accomplish what your distro can already do natively. I've never been a fan of willful ignorance and fearmongering, and I see a lot of that when it comes to SELinux.

toyg 4y ago
If it's been around 20 years and most people still loathe it, it probably isn't nice to work with.
- Zurrrrr 4y ago
  It could certainly be a lot nicer and more straightforward (and there are competing solutions that are), but people vastly exaggerate the difficulty of learning it, and dismiss the advantages that come from having it properly configured.
TheDong 4y ago
If your goal is a usable immutable distro, selinux is the wrong tool. It just doesn't operate at the layer of creating a linux distro, or declaring what containers are running, or declaring a list of flatpak apps, or whatever. My point, by comparing selinux to "mount" and calling them equally useless, was not that they are not useful tools in their niches. My point was that they are useless if your goal is to build a usable immutable distro. SELinux is a hammer that cannot be used to turn a default debian installation into a usable immutable linux distro. The initial claim of "using SELinux rather than a dedicated distro can work" was nonsense, so of course the thread of replies off this is nonsense. GIGO as they say.
- Zurrrrr 4y ago
  > SELinux is a hammer that cannot be used to turn a default debian installation into a usable immutable linux distro. It's only a hammer if you use it as one. It's a very fine grained tool and it can be as precise as you want it to be. > The initial claim of "using SELinux rather than a dedicated distro can work" was nonsense It wasn't at all, and it's baffling to me why anyone would claim so.

toyg 4y ago

If it's been around 20 years and most people still loathe it, it probably isn't nice to work with.

Zurrrrr 4y ago
It could certainly be a lot nicer and more straightforward (and there are competing solutions that are), but people vastly exaggerate the difficulty of learning it, and dismiss the advantages that come from having it properly configured.

TheDong 4y ago

If your goal is a usable immutable distro, selinux is the wrong tool. It just doesn't operate at the layer of creating a linux distro, or declaring what containers are running, or declaring a list of flatpak apps, or whatever. My point, by comparing selinux to "mount" and calling them equally useless, was not that they are not useful tools in their niches. My point was that they are useless if your goal is to build a usable immutable distro. SELinux is a hammer that cannot be used to turn a default debian installation into a usable immutable linux distro. The initial claim of "using SELinux rather than a dedicated distro can work" was nonsense, so of course the thread of replies off this is nonsense. GIGO as they say.

Zurrrrr 4y ago
> SELinux is a hammer that cannot be used to turn a default debian installation into a usable immutable linux distro. It's only a hammer if you use it as one. It's a very fine grained tool and it can be as precise as you want it to be. > The initial claim of "using SELinux rather than a dedicated distro can work" was nonsense It wasn't at all, and it's baffling to me why anyone would claim so.