Hacker News Reader

Comment by chucky_z | Hacker News Reader

May I disagree partially, using this authors exact words?

"... Unless you are a high risk target, spending almost any time beating SELinux into shape on your machine is a bad tradeoff and pretty much a waste ..." -- https://utcc.utoronto.ca/~cks/space/blog/linux/SELinuxToxicM...

If you are a high risk target, SELinux is a great option.

Also, to refer to the partial disagreement, here is my exact feeling...

"I'm a security aware sysadmin and yet yesterday I casually admitted that I made less-secure choices because the really secure option was too annoying and potentially inconvenient. In fact this is not the only case where I make this tradeoff, picking a less secure but more convenient option..." -- https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNotImp...

View on HN

I don't think you're disagreeing with the author. His statement was equivalent to "If you are not a high risk target, SELinux may be a bad choice". Since he used 'unless', I'm assuming his intent was the same as yours, "If you are a high risk target, SELinux is a great option."

I was simply disagreeing with the title of "SELinux is beyond saving." SELinux doesn't need saving for those who have a strong use-case. There are some great lesser alternatives like AppArmor, grsec, TOMOYO, and AKARI if SELinux can't work for you. :)

I did a quick review of available solutions some time ago, and what you're listing (apart from apparmor) is not an alternative. I'm assuming that if you're serious about security and capable of digging into complexity, you can just stay with selinux. So if you lack those:

grsec (rbac) - distributions don't really include it apart from arch, gentoo, and other high-maintenance ones; default targetted configs not included

tomoyo - easy to use for developers, but also often not available in default kernel; for normal users? start by explaining to them what syscalls and ioctls are; default targetted configs not included

akari - you're on your own to compile it in, and the tools, and figure out which version you want, and ... (not simple process); default targetted configs not included

apparmor - the only user-friendly alternative right now

> There are some great lesser alternatives like AppArmor, grsec,

Lesser? grsecurity is actually a far superior alternative to SELinux: https://grsecurity.net/compare.php

It's unfortunate that their stable patches are no longer available publicly: https://grsecurity.net/announce.php

Well, unless you've been blocked from getting it by what's-his-name.

Reply on news.ycombinator.com