3 ms·

> while production systems are generally hardened with SELinux and AppArmor out of the box, making practically exploiting them much harder. Is it really so? I

> while production systems are generally hardened with SELinux and AppArmor out of the box, making practically exploiting them much harder. Is it really so? I get an impression that SELinux is a so complicated that nobody wants to bother with setting it up and everyone disables it as soon as possible.

mikaraento 3y ago
You are correct about SELinux in general terms. However, there is a large scale exception to this: Android. Android uses SELinux extensively, and it is also used as part of further sandboxes in Chrome and Android System Intelligence.
bayindirh 3y ago
We don't disable SELinux unless the software explicitly requires it. Also, all of the machines running without SELinux are not accessible from outside. SELinux is complicated, but it's not impossible to work with. Configuring new rules is another story, though.
gizmo686 3y ago
RHEL systems run SELinux in enforcing mode by default. Most applications run in a domain called "unconfined_t", which is about as secure as it sounds. [0] Ubuntu runs AppArmor in its version of enforcing mode. I've only ever run into issues with it once though, so I presume it is a similarly lax policy. [0] The policy is called "targeted", to reflect the fact that you are supposed to write targeted policy modules for specific applications you are concerned about.
- bayindirh 3y ago
  Debian’s AppArmor policy is pretty strict, yet well refined. As long as you use standard folders and paths, it’s pretty invisible. Last time while I was migrating a DNS server, our zone folders were not in a standard path, and Bind was unable to find them. 10 minutes later I remembered about AppArmor, and moved the files. The only problematic hardening was Thunderbird, which broke attachments. They disabled the Thunderbird’s profile after failing to fix it. Currently I’m on mobile, so I can’t give you a list of active profiles, yet the list is not short and the policy is not lax. I worked with both of them back in the day and developed profiles for them. Update: Stats are as follows: 78 packages ship AppArmor profiles in Debian 12. Notable are: - mariadb-server - redshift (f.lux alternative) - bind - ioquake3 (yes, the game) - squid - tcpdump among others. Also there are "apparmor-profiles" and "apparmor-profiles-extra" packages which provides profiles for vsftpd, dovecot, dhcpd amongst others (141 in profiles and 10 in extras). So, AppArmor ecosystem is neither lax, nor unmaintained.
ktm5j 3y ago
Honestly I can't remember the last time I had an issue with SELinux on any of my desktop systems. I've had to work past some issues with systems I manage for work, but those weren't too bad to deal with.
samus 3y ago
SELinux is enabled by default on many production-grade distros, most notable Fedora. It's the distro maintainer's duty to ship policies. Yes, you need to write policy files for bespoke software, but SELinux has gotten better at helping to generate these.
hollerith 3y ago
I've been running Fedora for about 2 years, and have never been tempted yet to turn off selinux. (And I just used the 'sestatus' command to verify that it is enabled. "Current mode: enforcing", it elaborates.)

mikaraento 3y ago

You are correct about SELinux in general terms. However, there is a large scale exception to this: Android. Android uses SELinux extensively, and it is also used as part of further sandboxes in Chrome and Android System Intelligence.

bayindirh 3y ago

We don't disable SELinux unless the software explicitly requires it. Also, all of the machines running without SELinux are not accessible from outside. SELinux is complicated, but it's not impossible to work with. Configuring new rules is another story, though.

gizmo686 3y ago

RHEL systems run SELinux in enforcing mode by default. Most applications run in a domain called "unconfined_t", which is about as secure as it sounds. [0] Ubuntu runs AppArmor in its version of enforcing mode. I've only ever run into issues with it once though, so I presume it is a similarly lax policy. [0] The policy is called "targeted", to reflect the fact that you are supposed to write targeted policy modules for specific applications you are concerned about.

bayindirh 3y ago
Debian’s AppArmor policy is pretty strict, yet well refined. As long as you use standard folders and paths, it’s pretty invisible. Last time while I was migrating a DNS server, our zone folders were not in a standard path, and Bind was unable to find them. 10 minutes later I remembered about AppArmor, and moved the files. The only problematic hardening was Thunderbird, which broke attachments. They disabled the Thunderbird’s profile after failing to fix it. Currently I’m on mobile, so I can’t give you a list of active profiles, yet the list is not short and the policy is not lax. I worked with both of them back in the day and developed profiles for them. Update: Stats are as follows: 78 packages ship AppArmor profiles in Debian 12. Notable are: - mariadb-server - redshift (f.lux alternative) - bind - ioquake3 (yes, the game) - squid - tcpdump among others. Also there are "apparmor-profiles" and "apparmor-profiles-extra" packages which provides profiles for vsftpd, dovecot, dhcpd amongst others (141 in profiles and 10 in extras). So, AppArmor ecosystem is neither lax, nor unmaintained.

ktm5j 3y ago

Honestly I can't remember the last time I had an issue with SELinux on any of my desktop systems. I've had to work past some issues with systems I manage for work, but those weren't too bad to deal with.

samus 3y ago

SELinux is enabled by default on many production-grade distros, most notable Fedora. It's the distro maintainer's duty to ship policies. Yes, you need to write policy files for bespoke software, but SELinux has gotten better at helping to generate these.

hollerith 3y ago

I've been running Fedora for about 2 years, and have never been tempted yet to turn off selinux. (And I just used the 'sestatus' command to verify that it is enabled. "Current mode: enforcing", it elaborates.)