4 ms·

The first thing many do in the real world, after installing RHEL or the free derivatives is ... turn off SELinux.

worthless-trash 2y ago
It is a great way to show which people care about security. I equate (and I am likely not alone) that this would be a modern equivalent of chmod -R 777 / in early Unix computing. Use of AppArmour/SElinux is probably a good filter during an interview to determine if a person is a good fit for a security conscious position.
- iforgotpassword 2y ago
  Hard disagree. FS permissions take like 5 minutes to explain and then you maybe need another 30 minutes in total to try around and get a hang of it. I've given up on selinux every time I've tried to make sense of it. Open 3 different tutorials, have 3 totally different approaches to it. I guess if you only install core packages on redhat and never touch a single config file it might work OK even for the average Joe.
  - TheNewsIsHere 2y ago
    I found that for me, SELinux is best mastered by reading the documentation. Most tutorials I read when trying to make custom policies and monitor how policies were working, were hot garbage written by people who were just reading other people’s tutorials. SELinux solves problems orthogonal to FS permissions, and use cases that FS permissions alone don’t address. It was a bit tough at first but writing your first SELinux profile is a fantastic way to make it approachable. YMMV, of course.
  - ungamedplayer 2y ago
    I guess I must be wrong. So many people disagree with me I must be an idiot. You can write and understand llms but not selinux policies.. You are right, the crowd has spoken. Thank you for the education hn.
znpy 2y ago
> The first thing many do in the real world, after installing RHEL or the free derivatives is ... turn off SELinux. The people with port 631 publicly reachable didn't configure their firewall either (neither at OS level nor at infrastructure level) so what now, firewalls are useless?
yrro 2y ago
If you want to get fired, sure!
- shrubble 2y ago
  I know of 2 large telecoms where this happens! However they have large firewalls in front of the servers.

It is a great way to show which people care about security. I equate (and I am likely not alone) that this would be a modern equivalent of chmod -R 777 / in early Unix computing. Use of AppArmour/SElinux is probably a good filter during an interview to determine if a person is a good fit for a security conscious position.

iforgotpassword 2y ago
Hard disagree. FS permissions take like 5 minutes to explain and then you maybe need another 30 minutes in total to try around and get a hang of it. I've given up on selinux every time I've tried to make sense of it. Open 3 different tutorials, have 3 totally different approaches to it. I guess if you only install core packages on redhat and never touch a single config file it might work OK even for the average Joe.
- TheNewsIsHere 2y ago
  I found that for me, SELinux is best mastered by reading the documentation. Most tutorials I read when trying to make custom policies and monitor how policies were working, were hot garbage written by people who were just reading other people’s tutorials. SELinux solves problems orthogonal to FS permissions, and use cases that FS permissions alone don’t address. It was a bit tough at first but writing your first SELinux profile is a fantastic way to make it approachable. YMMV, of course.
- ungamedplayer 2y ago
  I guess I must be wrong. So many people disagree with me I must be an idiot. You can write and understand llms but not selinux policies.. You are right, the crowd has spoken. Thank you for the education hn.

znpy 2y ago

> The first thing many do in the real world, after installing RHEL or the free derivatives is ... turn off SELinux. The people with port 631 publicly reachable didn't configure their firewall either (neither at OS level nor at infrastructure level) so what now, firewalls are useless?

yrro 2y ago

If you want to get fired, sure!

shrubble 2y ago
I know of 2 large telecoms where this happens! However they have large firewalls in front of the servers.