8 ms·
FWIW, I’ve worked at many RedHat shops over the years and I’ve never seen one where disabling SELinux wasn’t a normal part of provisioning a server. I haven’t s
by semiquaver 2y ago
FWIW, I’ve worked at many RedHat shops over the years and I’ve never seen one where disabling SELinux wasn’t a normal part of provisioning a server. I haven’t seen the same thing with AppArmor (although I admit I have less visibility into debian systems administration). YMMV but it seems to me that a component which is so inconvenient that it’s normally disabled doesn’t provide much security in the end.
- giancarlostoro 2y agoThis reminds me of my college years and the one time we used Fedora and someone accidentally set it up with SELinux, we spent hours pulling our hairs out trying to figure out why nothing worked. Only to finally realize SELinux was the culprit and we needed to turn it off.
- mhitza 2y agoSELinux has been enabled on Fedora for as long as I remember. SELinux is complex, badly documented, policy code is obscure macro incantation, and basic debugging tools often aren't installed out of the box on server distros (such as audit2allow). But for the day to day administration of systems, policies are included for distribution packages and most issues can be fixed by enabling a boolean here and there, and relabeling files. The principles, basic admin & debugging part can be learned in a couple of hours, and when you have custom service software, you can throw it in /opt and have it run unconfined (ie: not subject to SELinux rules).
- XorNot 2y agoIt's baffling to me that SELinux's UI is like...the best we can apparently do? The underlying concepts of SELinux aren't so hard but trying to manage it in any sort of coherent way is a nightmare - up to and including the provisions in it for a network based policy server component which just never appeared. And it sucks! In theory it does so many things we really really want, and should do more. Like I as a user have a great interest in ensuring my home directory files follow sensible markings based on their content - my SSH keys, AWS keys, or banking files all exist in different logical zones of control. And this is a concept SELinux can handle...but the tools are just so bad at surfacing it.
- TheRealPomax 2y agoWhy would the NSA want to make something easy to use for others?
- Gud 2y agoWhy wouldn't they?
- gizmo686 2y agoBecause that's not their job. The NSA sponsored the development of SELinux because they needed something to solve their problems. The current state of SELinux does that. Why would they spend resources solving problems that they don't have.
- deleted 2y ago[deleted]
- TheRealPomax 2y agoKind of a weird counter-question? Why would any business spend more effort on building a tool than is necessary to make the tool they need? The NSA doesn't care about brownie points.
- throwaway894345 2y agoI haven’t touched SELinux. How does it compare to Systemd (presently my standard for “ubiquitous despite terrible UX”).
- giancarlostoro 2y agoReminds me of git itself, you read about its internals it sounds easy. You start trying to figure out how to map commands in a way that makes sense, it baffles you when things break.
- mike_hearn 2y agoIt's not. The (undocumented!) SBPL that Apple OS' use is easier to understand and debug than selinux, in my experience.
- jerf 2y ago"The principles, basic admin & debugging part can be learned in a couple of hours," In principle, yes. In reality I've gone looking for a resource that I could do this with and come up short. (I am starting to get really annoyed at things where I can find a million "paste this bit to do that thing" and there are so darned many of those on the internet that any hope of finding a good resource that gets to the underlying structure such that I can figure out how to do these things myself is virtually nil. It seems like this is getting worse as the search engines continue their trend of taking your query as a vague suggestion of the sort of thing you're looking for.)
- mhitza 2y agoMaybe I'll write that guide, and then (fingers crossed) people will find it via search engines (before all search engines become just an LLM frontend).
- jerf 2y agoWell, if you do, my email is in my profile and I'll be happy to be an advance proofreader if you're interested. I've got a couple of teens in a very similar position as well, so I can even provide multiple people's point of view. I have pretty much the exact right amount of experience for that; I've been in there, I've done things, even completed a couple of non-trivial projects (nothing amazing, but, more than just "a pad with a pocket in it"), I recognize I'm confused, I don't know where to proceed from there.
- jerf 2y agoScratch this, this was in error. It referred to a version of the post I never posted and I got myself confused.
- KAMSPioneer 2y agoI mentioned elsewhere in the thread, I (well, my employer) picked up a copy of a book on SELinux System Administration (that's the title) and it has served just this function for me. It won't make you an expert but it takes the voodoo out of the whole process, if that makes sense. And it is reasonably short if you skip the stuff that you're (probably) never going to configure like passing labelled traffic between hosts with IPSEC.
- ThatMedicIsASpy 2y agoI've had no issues for personal use. Be it Fedora or Fedora Server. When I ran into issues the logs often come with a solution.
- goneri 2y agoDisabling SELinux is pretty much like doing a chmod -R 777 ., it may fix your "problem", but it's certainly not the long term solution.
- area51org 2y agoI wouldn't say it's that drastic. Also, SELinux can give you a false sense of security. It's best to harden the system overall instead of relying on one security feature (however good it might be).
- speckx 2y agoThis has worked for me in the past, but it's not something anyone should do in production. ;) Then again, Disabling SELinux is necessary. For example, cPanel requires disabling SELinux on CentOS, AlmaLinux OS, CloudLinux, and Rocky Linux. AppArmor is fine on Ubuntu (https://docs.cpanel.net/installation-guide/system-requirements-ubuntu/ https://docs.cpanel.net/installation-guide/system-requiremen...).
- rurban 2y agoIt's not necessary, it's a stupid dick move. cPanel was just not capable to tune the selinux profiles for their services, I've worked there. My servers all run with selinux, it's really trivial. Just the ssh client and tailscale recipes are missing by default. Selinux gives you precise choices if something is rejected.
- commandersaki 2y agoHah, came here to say this as well.
- Go7aiTha 2y agoThe k8s nodes in Oracle system are shipped with SELinux (permissive mode). One of the those nodes was extremely slow and we found out it's due to SELinux . We have to completely turn SELinux off, reboot the machine, and well, our pod start time reduced from 5 minutes to a few seconds.
- dspillett 2y agoThat much difference in boot time with no other changes would suggest to me something (or multiple somethings) calling out in a way blocked by SELinux, and timing out rather than failing quickly. You might want to check that you don't have any undesirable calling home going on from some of your containers.
- candiddevmike 2y agoIMO, it's because relying on filesystem labels and compiled policies (SELinux) ended up being a poor design choice vs defining the access in easy to understand policy files (AppArmor).
- nicce 2y agoAppArmor is easier to understand because it is simply less restrictive, and in that way it is less effective solution. I would not call SELinux as poor design choice because of that. You can't do things with AppArmor that you can with SELinux.
- candiddevmike 2y agoSorry, I was responding to the parent's question about why one was disabled over the other. Yes, SELinux is more capable, at the cost of additional complexity. I think it's debatable how many companies need that complexity, especially outside of the federal space.
- vundercind 2y agoI’d bet money the main practical purpose SELinux serves is to check boxes when negotiating government contracts, in a way that’s familiar and can be called a standard. Then in practice someone ends up writing a couple policy statements and filing a couple forms then disabling it anyway, nearly every time. If that’s the case it doesn’t need to actually work in practice, just hypothetically.
- ruthmarx 2y agoI've never seen SELinux as a requirement for any auditing, and I've done a fair amount of auditing. It's not the only project like it, it's the one that is most well known because it has the NSA attached and because it got incorporated into the main kernel. It works in practice, absolutely, but most people are too intimidated or lazy to put in the effort to learn it.
- jklinger410 2y ago> I’ve never seen one where disabling SELinux wasn’t a normal part of provisioning a server This is so funny because whenever I suggest Fedora Silverblue to a moderately experienced Linux user who wants a simple distro, the first thing I do is recommend turning SELinux on permissive mode, and I get a bunch of comments hand wringing about how you shouldn't do that. It's almost like a silent filter working in the background of your OS that doesn't even tell you when it blocks something is a pretty user hostile feature and no one wants to learn how to speak SELinux so they can effectively use it. Sometimes it seems like Linux people don't want others using it. Even when they belong to evangelist platforms, they like to create huge barriers for entry and then blame new users for not "getting it."
- m4rtink 2y agoI think all the SELinux denials are logged in Journal and there are good tools to analyze them and possibly turn them to rule changes if necessary.
- minkles 2y agoI never turned off SELinux. There are a few of us out there!
- NewJazz 2y agoThe infra team at my work is now keeping it on for new EL9 installs due to pressure from the security team, but for the past 10-15 years they kept it disabled. I'm hoping it sticks. Just check audit logs when you get an error, it is not that hard, right?
- pjmlp 2y agoAll the people using Android phones as well.
- EvanAnderson 2y agoI always pushed back hard on vendors who wanted me to disable SELinux on my RHEL boxes. It's unacceptable to disable default OS security protections to make an application function. It's no different than demanding an app run as root.
- 01HNNWZ0MV43FF 2y agoOops -- A developer whose app needs to run as root (for a well-documented reason, and with a tight systemd sandbox hiding most of the filesystem from it)
- NewJazz 2y agoIf it is running as root, can't it just manipulate its mount namespace at will? Mount devtmpfs, then mount user partitions.
- superb_dev 2y agoSystemd can put it in its own namespaces, like a container
- hackernudes 2y agoI believe one can use "capabilities" and seccomp to lock down a superuser process.
- stevekemp 2y agoIndeed, disabling SELinux is like following instructions for PHP applications and running "chmod -R 777 /var/www". I used to work at a payment provider and we had to deal with lots of monitoring and security stuff. Some of it was (obviously) busywork and needless checkbox filing, but other parts were genuinely useful. Setting up systems was tedious and difficult, but ultimately worthwhile and necessary.
- bigfatkitten 2y ago> Indeed, disabling SELinux is like following instructions for PHP applications and running "chmod -R 777 /var/www". HP at one point said to "chmod -R 777 /sbin" in their ArcSight install documentation, and that's a 'security' product.
- redprince 2y agoBecause pretty much everyone on the internet tells you to disable SELinux instead of trying to understand it. I'm always rolling my eyes when I open some deployment instruction for RHEL (clones) and they have as step one: Disable SELinux. Few will instead read the RHEL provided documentation. Then they could maybe figure out whether there's simply a tunable (getsebool -a) which would enable the desired behavior, or if properly labeling files (semanage fcontext / restorecon) would do it, or even take the steps to add to an existing policy to allow for a specific scenario which somehow was not implemented. Even adding your own policies "from scratch" is certainly doable and provides a great safety net especially for networked applications. Anyway... we all know disabling security or not implementing it in the first place can really save you a lot of time. At least in the short run.
- wwweston 2y agoAre there good places to read more about this?
- redprince 2y agoIf you just want to maintain or operate what's already there on a RHEL (clone): https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/using_selinux/index https://docs.redhat.com/en/documentation/red_hat_enterprise_... If you want to dive deeper: "SELinux System Administration" by Sven Vermeulen.
- mananaysiempre 2y agoA book published by Packt? Really? Honest question, it’s just that so far I haven’t noticed them having much of a quality filter or an editing team.
- epalm 2y ago> Anyway... we all know disabling security or not implementing it in the first place can really save you a lot of time. At least in the short run. The way I put it to my clients, and staff, is simply that security comes at the cost of convenience.
- citrin_ru 2y agoSELinux is pain to maintain in more or less complex system. I more like approach taken by OpenBSD [1] but it requires code changes. [1] https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2
- mrweasel 2y agoPledge and Unveil makes a ton of sense, because it moves the responsibility to the developer who should know the application better than the systems administrator. Sometimes, when the developers make a mistake, which is unavoidable in a large project, it is nice to be able lock down applications as the administrator.I just don't think SELinux is the right tool, because the chance of you making a mistake in the configuration is pretty high. The functionality is there, but it needs to be easier to write policies and maybe that comes at the cost of some flexibility.
- nequo 2y ago> the developer who should know the application better than the systems administrator On the other hand, the administrator knows their system better than the developer. There could be certain network connections or file paths that you want to block on one system but not on another.
- ruthmarx 2y agoThe OpenBSD approach isn't even in the same league. Not only it is developer opt-in, but it is also limited to enforcing or restricting syscalls, that's it. If you have a root RCE in say sshd, pledge won't help you. SELinux will.
- bluedino 2y agoExact opposite here, all the RHEL shops I've worked at were required to have SELinux for industry/security regulations. Most of the places who used CentOS for a 'free' Linux ended up shutting it off, though.
- CrLf 2y agoSELinux suffers from a reputation problem. It gained that reputation early on, while default policies were still very immature and overly restrictive. One crucial change for the better was leaving third-party software in a permissive state. From that point onwards, disabling SELinux is cargo-cult sysadmin'ing. SELinux is not hard if you understand its basic principles. But no one bothers, because SELinux is the bogeyman. Yes, writing policies means getting knee-deep in macros, and it's hard because many services try to access anything and everything. But almost no one needs to write a policy. At most you need to tell SELinux that some non-default directory should have some label. That's not hard.
- cesarb 2y ago> At most you need to tell SELinux that some non-default directory should have some label. That's not hard. In my experience, it's not just directory labels ("semanage fcontext -a -e ..." and friends). You also need once in a while to set some booleans ("semanage boolean ..."). Yes, it's not hard once you know about it.
- noinsight 2y ago> But almost no one needs to write a policy. But that's exactly what I would like to do! I've never seen a real guide for how to set up a policy for a custom daemon I wrote myself. Or when a specific software doesn't come with a policy.
- CrLf 2y agoIt's true that there is a lack of simplified documentation. But that lack is also the result of the folks that would otherwise contribute to such documentation not even giving SELinux a chance. Many years ago I decided to face the Bogeyman and went from knowing very little about SELinux to writing a policy from scratch in about a month. The policy is simple enough (but realistic) that it might help in the absence of a guide: https://github.com/carlosefr/kyoto/tree/master/selinux https://github.com/carlosefr/kyoto/tree/master/selinux I used it as an example in a couple of talks, whose slides might also provide additional context: https://github.com/carlosefr/public-talks/blob/master/presentations/selinux_en_campfire_2017.pdf https://github.com/carlosefr/public-talks/blob/master/presen...
- darkwater 2y agoSecurity folks usually are detached from the actual reality, unfortunately. Yes, people/sysadmins should take their time to properly configure SELinux when things don't work, instead of just disabling it completely for good. I tried for a whole year in a place where we used CentOS, and then finally I gave up, too many hours wasted in finding the right conf for this new program or configurations etc.
- Spivak 2y agoI feel like I'm taking crazy pills in this thread. SELinux is so easy to set up in anything RHEL 7+. Everything from the distro works ootb, the auditor will tell you exactly what caused the error, it will give you the commands to fix it, and you can label programs you don't want to deal with with unconfined_t. There's no reason to completely disable it, you lose all the benefit of all the software Red Hat engineers have already made work with it.
- darkwater 2y ago(this was in 2016) Yes, usually the logs pointed you in the right direction, but it still made things more complicated and trick the "lazy attitude" in many people (or, at least, in me).
- AnonCoward42 2y agoI keep SELinux enabled at all times, but it does break quite often. For the sake of sticking to Fedora, wg-quick (wireguard) does not work out of the box. On OpenSUSE/MicroOS who is employing SELinux boot takes about 5 minutes on every kernel change, because of home-relabel. I hear you, that they probably do it wrong, but that's what you get with SELinux. Not enough to push me to disable SELinux, but maybe to avoid SELinux distributions in the future.
- OSI-Auflauf 2y agoI use wg-quick via the parameterized systemd unit (wg-quick@.service) all the time and never had selinux blocks. Which fedora are you on?
- master_crab 2y agoThis. Disabling Was always the first step when we used RHEL years ago. SEL seems to work under the premise that if it’s too complicated for you to use, the attacker has no chance.
- SAI_Peregrinus 2y agoThe "CIA triad" definition of security (Confidentiality, Integrity, and Availability ) is most often violated by loss of the Availability component. Very often by "security" mechanisms that effectively serve as a Denial of Service attack on the users. A system which is easy to use securely will stay secure, a system which is difficult to use securely will be insecure.
- mst 2y agoRule 777: If you make a system secure but difficult to use, your users will find a way to make it easy to use but insecure.
- turtle_heck 2y agoEvery RHEL server we ever provisioned (dev, testing, prod, vm, physical, etc) had it enabled, everyone who blindly disables it is lazy.
- cvhc 2y agoI just feel SELinux would add too much burden to sysadmins. I use CentOS + SELinux in one of my VPS and it's already painful. I've been sysadmin in university labs for some years. I did what I think is reasonable, setup a firewall, limit root access, never trust lab servers to the extent that I forward my SSH agent on it... But I don't want users come to me every time they want to run a custom / proprietary program and I spend time writing and debugging MAC rules. And I don't agree with the article that containers do not add security. Container runtime implements namespace isolation, seccomp filters, etc. and that reduce the attack surface, comparing to running the software directly on the host OS. More importantly in this discussion, it is convenient for sysadmins. There is no perfect security anyway. And I don't sacrifice convenience for national security level security :)
- quasarj 2y agoThank you.. came here to say exactly this. Who the heck is using SELinux? hah
- ruthmarx 2y ago> I’ve never seen one where disabling SELinux wasn’t a normal part of provisioning a server. These days that's just laziness/fear, and it's a shame to see it. It doesn't even make sense any more.
- nobody42 2y agoIt's a symptom. Seems that label-based MAC is too tightly coupled with other parts of the system. With path-based, there's no need to disable it (entirely) because each part have their own separated strict scope.
- nineteen999 2y agoWhen you are working in an industry where peoples lives are at stake, then it matters. It matters less if your business is just selling internet-widgets or what not. We don't disable SELinux.
- WhyNotHugo 2y agoI think the article summarises the situation well: > The policy language and tooling is cumbersome, obtuse, and is about as appealing as filling out tax forms. If a security framework is so terribly complex and hard to use, then people won’t use it. OTOH, look at how OpenBSD or OpenSSH approach security: simply primitives which are well documented and easy to understand. The only reason SELinux even works in the few scenarios where it does, is because the operator had immense amount of resources to pour into it. This itself is another sign of how bad the design is: it’s so complex that no small team of humans have ever been able to use it.
- bravetraveler 2y agoWell, the comparison is flawed. Apparmor does nothing for applications not explicitly enabled or enrolled SELinux does better or worse, depending on perspective, by actually enforcing controls