3 ms·
Has SELinux become configurable on the command-line with well documented tools? Does it still occasionally decide to "relabel files" for 10 hours on a random re
by kbolino 3y ago
Has SELinux become configurable on the command-line with well documented tools? Does it still occasionally decide to "relabel files" for 10 hours on a random reboot?
It's a great mechanism in theory, but the practice leaves much to be desired.
- DEADMINCE 3y agoIt's a great mechanism in practice, it just has a bad rep because too many were scared by the complexity.
- kbolino 3y agoThe complexity is a self-inflicted problem. This is a rake that many computer security people refuse to stop stepping on. If it's not usable then it doesn't work. FWIW it does look like Gentoo stepped up and filled in the gaps since I last looked. Their Wiki has good docs starting from https://wiki.gentoo.org/wiki/SELinux https://wiki.gentoo.org/wiki/SELinux.
- znpy 3y agoYes and no. But the thing is... SELinux does complex stuff. You can simplify that, but only to a certain point. If you dumb it down too much it becomes useless. Simple tools usually get their simplicity by making some choices for you. You don't always want that. SELinux is one of those things where you don't want that. That being said, without diving too much, I have configured many custom services to run under SELinux by just running them in a dev/staging environment, collecting violations and creating policies via the audit2allow tool. So yeah, things have improved I guess.
- deleted 3y ago[deleted]
- kbolino 3y agoIn my experience, SELinux is the sort of thing you avoid unless you're forced to use it, then when you are forced to use it, you're encouraged to stumble around until you get it out of your way, then forget about it until it gets in your way again. Good documentation and good tools would encourage more people to use it and understand it willingly and effectively.