4 ms·
Nah. Root user actual capabilities can be limited in a number of ways. On RHEL this is done by default via SELinux. If you define a policy that prevents anyon
by znpy 3y ago
Nah. Root user actual capabilities can be limited in a number of ways.
On RHEL this is done by default via SELinux.
If you define a policy that prevents anyone from doing kexec, and enable the boolean to prevent root from disabling enforcing mode for selinux, there you go, done with tools that have been available for ~15-20 years.
- kbolino 3y agoHas SELinux become configurable on the command-line with well documented tools? Does it still occasionally decide to "relabel files" for 10 hours on a random reboot? It's a great mechanism in theory, but the practice leaves much to be desired.
- DEADMINCE 3y agoIt's a great mechanism in practice, it just has a bad rep because too many were scared by the complexity.
- kbolino 3y agoThe complexity is a self-inflicted problem. This is a rake that many computer security people refuse to stop stepping on. If it's not usable then it doesn't work. FWIW it does look like Gentoo stepped up and filled in the gaps since I last looked. Their Wiki has good docs starting from https://wiki.gentoo.org/wiki/SELinux https://wiki.gentoo.org/wiki/SELinux.
- znpy 3y agoYes and no. But the thing is... SELinux does complex stuff. You can simplify that, but only to a certain point. If you dumb it down too much it becomes useless. Simple tools usually get their simplicity by making some choices for you. You don't always want that. SELinux is one of those things where you don't want that. That being said, without diving too much, I have configured many custom services to run under SELinux by just running them in a dev/staging environment, collecting violations and creating policies via the audit2allow tool. So yeah, things have improved I guess.
- deleted 3y ago[deleted]
- kbolino 3y agoIn my experience, SELinux is the sort of thing you avoid unless you're forced to use it, then when you are forced to use it, you're encouraged to stumble around until you get it out of your way, then forget about it until it gets in your way again. Good documentation and good tools would encourage more people to use it and understand it willingly and effectively.
- mort96 3y agoCan selinux be configured to prevent root from loading a kernel module..?
- DEADMINCE 3y ago[flagged]
- znpy 3y agoyes.
- mort96 3y agoWell TIL. I had no idea SELinux was so user hostile.
- znpy 3y agoYes, it is hostile to malicious users, that’s by design and it’s a feature. That being said, it can be configured that way but (of course, duh) it’s not the default setting. I’ll stop replying here because this branch of the discussion doesn’t seem to be any constructive on your side (or even conducted in good faith, to be honest)
- mort96 3y agoThe problem is, there's a very very narrow line between restricting what the user can do on their system for the user's benefit and restricting what the user can do on their system for your benefit as the manufacturer/whatever. That's what makes the idea of restricting the root user so uncomfortable.
- znpy 3y agoNow you’re being dishonest and posting actual bs. There is no such line. Everything is foss software, you can change any policy. You can still do everything you want.