SELinux and confined users, make the Linux Desktop more secure (discussion.fedoraproject.org)
from Pantherina@feddit.de to linux@lemmy.ml on 05 Oct 2023 00:11
https://feddit.de/post/4180633

#linux

threaded - newest

NanoooK@sh.itjust.works on 05 Oct 2023 06:21 next collapse

Is Fedora the only mainstream desktop distribution to ship with SELinux?

Sh1nyM3t4l4ss@lemmy.world on 05 Oct 2023 07:42 next collapse

I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.

I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.

Neon@lemmy.world on 05 Oct 2023 09:56 next collapse

yeah, same. I am currently on NixOS, but looking to move away because it’s lacking support any MAC. I really love NixOS and it’s declarative approach to things, but i can’t live with such a large security hole in my home Network.

As soon as i find a Distro that has MAC and allows for at least semi-declarative configuration, i am switching. But being able to declare an env/dconf setting in my config and sync it across all devices is just too powerful

ladyanita22@lemmy.world on 05 Oct 2023 13:49 collapse

I suggest you check Silverblue + Ansible (or CoreOS/IoT for server stuff).

Neon@lemmy.world on 07 Oct 2023 09:27 collapse

while i think that ansible is really cool, it’s not the same as Nix.

correct me if i’m wrong, but afaik Ansible just modifies the current state of the System with a declarative configuration.

Nix reverts your system back to install and then applies the configuration. The result is that in Nix if i remove something from the configuration.nix it is as if it never existed, whereas on Ansible it stays unless i manually run a task to uninstall it.

BautAufWasEuchAufbaut@lemmy.blahaj.zone on 05 Oct 2023 09:58 collapse

Nitpick: it’s not that AppArmor isn’t as secure, it’s just that SELinux is more powerful. The security always is up to the profiles.
If you were to compare the policies for Fedora and e.g. Debian, I would assume Fedora has better ones though lol

ladyanita22@lemmy.world on 05 Oct 2023 13:47 collapse

For sure. I believe Debian’s AppArmor integration is a little bit of an afterthought and there’s lots of patches missing as Canonical likes to keep many improvements downstream.

eeleech@lemm.ee on 05 Oct 2023 07:54 next collapse

afaik yes, at least the arch kernel has selinux enabled, but you need to install the user space tools from the AUR.

ladyanita22@lemmy.world on 05 Oct 2023 17:13 collapse

But the profiles are pretty poor and basic AFAIK.

Pantherina@feddit.de on 06 Oct 2023 01:23 collapse

Maybe Opensuse?

NanoooK@sh.itjust.works on 06 Oct 2023 09:55 collapse

From what I’ve found it’s not implemented by default.

hottari@lemmy.ml on 05 Oct 2023 10:48 next collapse

SELinux will not magically make your system more secure. Desktop insecurity mostly boils down to poor user choices. E.g Granting vscode full access to your home folder and installing some random extension.

Flatpaks and similar “container” tools are the obvious tools to use if you care about desktop security which the Linux ecosystem still generally deems as a lesser priority over being able to gain “rootful” permissions to carry out administrative tasks.

ladyanita22@lemmy.world on 05 Oct 2023 13:45 next collapse

Nothing will make your system magically more secure, but SELinux is of great help when properly set up (as is in the case of Fedora).

possiblylinux127@lemmy.zip on 05 Oct 2023 16:39 collapse

Flatpak using either apparmor or selinux

joojmachine@lemmy.ml on 06 Oct 2023 01:00 collapse

neither, it uses bubblewrap, snap is the one that uses apparmor

MNByChoice@midwest.social on 05 Oct 2023 14:29 next collapse

SELinux has long suffered from usability issues. Many commercial software packages require SELinux be disabled.

Fix the docs, improve error messages, and create a GUI to improve usage.

[deleted] on 05 Oct 2023 15:46 next collapse

.

MNByChoice@midwest.social on 05 Oct 2023 16:09 collapse

I agree, but I don’t expect software companies to support it without clear documentation.

[deleted] on 05 Oct 2023 18:31 collapse

.

Kazumara@feddit.de on 05 Oct 2023 21:49 collapse

Recently a supplier of ours announced that we could finally host their shitty java app on Linux instead of paying fucking Oracle for Solaris. So we were eager to hear the requirements. It was RHEL 8.4 or something, a version that was already EOL at the time.

They can’t even update their distros apparently.

joojmachine@lemmy.ml on 05 Oct 2023 21:26 collapse

Hate to be the type of person to comment this, but patches more than welcome

for real though, even a small contribution to the docs helps a ton

joojmachine@lemmy.ml on 06 Oct 2023 01:03 next collapse

Anyone even slightly interested in this, join!

Seriously, I didn’t know jack about SELinux before joining the SIG and now I know a little less than jack about it (I tried confining my user and managed to be unable to login to my system)

iamak@infosec.pub on 06 Oct 2023 09:02 collapse

I’m interested. Can you tell me more about it?

joojmachine@lemmy.ml on 06 Oct 2023 11:37 collapse

You can just take a look at the links in the thread if you want to start testing, and can help report issues with your experiences in our Pagure repo, I still need to report mine to mnow if it’s a thing with GDM or if I just did something wrong

iamak@infosec.pub on 06 Oct 2023 16:57 collapse

Okay. Also how beneficial would this be for my résumé if I’m trying to get into cyber security field?

danielfgom@lemmy.world on 06 Oct 2023 03:58 next collapse

It was written by the NSA, that’s enough for me not to trust SELinux.

sugartits@lemmy.world on 06 Oct 2023 06:18 collapse

It’s open source and lots of eyeballs have looked at it.

It’s fine.

danielfgom@lemmy.world on 06 Oct 2023 08:33 next collapse

Maybe but there must be a reason 99% of distributions use AppArmor instead

andruid@lemmy.ml on 06 Oct 2023 08:36 collapse

AppArmor is less complicated. That’s the main reason

ryannathans@aussie.zone on 06 Oct 2023 10:28 next collapse

A backdoor written by NSA was literally found last month

milicent_bystandr@lemm.ee on 06 Oct 2023 10:43 collapse

Source?

01189998819991197253@infosec.pub on 06 Oct 2023 15:08 collapse

Really good points from here:

The “many eyes” theory is dead since the NSA backdoor in OpenSSL clearly showed how delusional that belief is. SELinux has never been audited by any trustworthy truly US-independent entity, making it nearly as untrustworthy as closed source. On top of that, there is always The Underhanded C Contest, proving that looking at the source is not enough. You need to be an expert who can detect underhanded backdoors too. – Evi1M4chine Feb 3, 2018 at 13:05

I don’t think the NSA’s official mission is a good reason to believe it wouldn’t add backdoors. The agency considers American citizens to be adversaries, not beneficiaries of its operations. – augurar Oct 21, 2014 at 4:23

rawfox@lemmy.ml on 06 Oct 2023 05:32 next collapse

I love it and it really makes my Desktop more secure. Switching it off, has lead to installing hostile or insecure software within months. When it was introduced, i felt controlled by it, but actually i saw, what a mess came out of it when i disabled that. Today i feel protected, out of eperience, even if i know shirt about how it exacly works, but i saw stupid software harming my system when it was disabled.

Pantherina@feddit.de on 06 Oct 2023 09:55 collapse

I am curious, do you have an example?

msage@programming.dev on 06 Oct 2023 11:16 collapse

A bit dated experience, but I wanted to make a ‘simple’ web app (nginx/fpm/psql) SELinux compatible in 2014.

After reading the docs, it seemed I needed three layers of configuration just to make a policy. For two ports and two folders, that seemed way too complicated and absolutely not worth it.