SELinux has long suffered from usability issues. Many commercial software packages require SELinux be disabled.
Fix the docs, improve error messages, and create a GUI to improve usage.
I agree, but I don’t expect software companies to support it without clear documentation.
Is Fedora the only mainstream desktop distribution to ship with SELinux?
afaik yes, at least the arch kernel has selinux enabled, but you need to install the user space tools from the AUR.
I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.
I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.
Nitpick: it’s not that AppArmor isn’t as secure, it’s just that SELinux is more powerful. The security always is up to the profiles.
If you were to compare the policies for Fedora and e.g. Debian, I would assume Fedora has better ones though lol
yeah, same. I am currently on NixOS, but looking to move away because it’s lacking support any MAC. I really love NixOS and it’s declarative approach to things, but i can’t live with such a large security hole in my home Network.
As soon as i find a Distro that has MAC and allows for at least semi-declarative configuration, i am switching. But being able to declare an env/dconf setting in my config and sync it across all devices is just too powerful
I suggest you check Silverblue + Ansible (or CoreOS/IoT for server stuff).
SELinux will not magically make your system more secure. Desktop insecurity mostly boils down to poor user choices. E.g Granting vscode full access to your home folder and installing some random extension.
Flatpaks and similar “container” tools are the obvious tools to use if you care about desktop security which the Linux ecosystem still generally deems as a lesser priority over being able to gain “rootful” permissions to carry out administrative tasks.
neither, it uses bubblewrap, snap is the one that uses apparmor
Anyone even slightly interested in this, join!
Seriously, I didn’t know jack about SELinux before joining the SIG and now I know a little less than jack about it (I tried confining my user and managed to be unable to login to my system)
You can just take a look at the links in the thread if you want to start testing, and can help report issues with your experiences in our Pagure repo, I still need to report mine to mnow if it’s a thing with GDM or if I just did something wrong
A bit dated experience, but I wanted to make a ‘simple’ web app (nginx/fpm/psql) SELinux compatible in 2014.
After reading the docs, it seemed I needed three layers of configuration just to make a policy. For two ports and two folders, that seemed way too complicated and absolutely not worth it.
