Hacker News Reader

Comment by fargle | Hacker News Reader

How can I trust some opaque policy I cannot see? Not just trust that it is well intentioned not evil, (Oracle Linux?), but that it does what it says. And does what I need and that the opaque developers have correctly envisioned what I need to do.

Security by obscurity is worse than none at all. Security by buying an "Enterprise" product is worse than that.

What SELinux says is "real MAC security is super complicated, but don't worry we've taken care of all that for you, but you can't understand it or change anything". What I say is "easy peasy; if you access the machine you're root. Make sure that either it doesn't happen or it doesn't matter".

View on HN

> but you can't understand it or change anything"

That is not true. SELinux is not hard to understand nor change. Most of the issues you might encounter are simply solved by changing a label in a file or directory. It is just not straightforward to debug and understand if you don't know it is there. I think most people who complain about it are multi distros/OS users and just only realize after losing precious time that an issue is selinux related.

But what am I, as the sysadmin, supposed to label things? Even if I know that I probably need to apply some labels, how do I find out what the policies are? What labels can interact with this program? You can turn to Google and find some incantations in a blog or forum post from ten years ago, but you can‘t easily see which labels a program is allowed to interact with or not. (If you even know to ask that question.)

Fedora comes with manpages. So for instance, say you want to place http pages outside of /var/www. Fedora comes with the selinux-policy-doc package, which gives you the httpd_selinux manpage:

https://linux.die.net/man/8/httpd_selinux

It's a tad dense, but in the Sharing Files you can find a section explaining what context is used and for what. You can also look at the existing context, eg:

    $ ls -laZ /var/www
    total 4
    drwxr-xr-x.  4 root root system_u:object_r:httpd_sys_content_t:s0       33 mar 17 17:32 .
    drwxr-xr-x. 21 root root system_u:object_r:var_t:s0                   4096 abr 18 10:57 ..
    drwxr-xr-x.  2 root root system_u:object_r:httpd_sys_script_exec_t:s0    6 mar 17 17:32 cgi-bin
    drwxr-xr-x.  2 root root system_u:object_r:httpd_sys_content_t:s0        6 mar 17 17:32 html

And copy those for your own use.

sesearch -A

That shows the list of what labels are allowed to do what to which labels, so run ps -Z to get the label of your process and grep the sesearch output for it, and that will tell you what labels it's allowed to interact with and in what ways.

selinux is generally pretty straightforward, but it has a reputation for being impenetrable which puts people of trying to learn it.

really? I don't mean understand how to apply a new label. I mean understand what the policies are and how they work, be able to create new ones that apply to you, and verify that the ones given to you by the distro are correct for your use. You're saying this is not hard to understand: https://github.com/SELinuxProject/refpolicy/blob/master/poli... ?

Otherwise you are blindly applying some black box.

Reply on news.ycombinator.com