97
Why do we hate SELinux? (lemmy.dbzer0.com)
submitted 1 year ago by to c/linux@lemmy.ml
66 comments fedilink hide all child comments
 

This is not a troll post. I'm genuinely confused as to why SELinux gets so much of hate. I have to say, I feel that it's a fairly robust system. The times when I had issues with it, I created a custom policy in the relevant directory and things were fixed. Maybe a couple of modules here and there at the most. It took me about 15 minutes max to figure out what permissions were being blocked and copy the commands from. Red Hat's guide.

So yeah, why do we hate SELinux?

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 year ago (4 children)

Its just complex.

I hate it for my Android device maintainer role much more than my Linux admin role...

On Android, its a fucking mess between vendor stuff and system stuff. But not for selinux itself, but for the mess that vendors often do.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 4 points 1 year ago* (last edited 1 year ago) (2 children)

    Its just complex

    When a security mechanism becomes more complex to manage than what it is supposed to protect, it becomes a vulnerability itself.

    If you had a minimal system that you built from the ground up yourself and wanted to only have that system function in very specific ways, SELinux would be perfect. I would go so far as to say it would be nearing perfection in some ways.

    Sorry, but in the real world, ain't nobody got time for that shit. If you use auto configuration tools or pre-canned configs for SELinux on a system you are unfamiliar with, it's more likely to cause application issues, create security gaps and will likely be shut off by a Jr. admin who really has no fucking clue what he is doing anyway.

    It's just easier to keep your system patched and ensure basic network security practices anyway.

    It's not impossible to manage these days. In the early days it was, but most everything is automagic now. If I am not mistaken, SELinux can be enabled to 'log only' which would give you data better handled by a HIPS anyway. (Don't quote me on that.)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •