While the stock policies have been refined to model more of an average user’s usage, the facility itself remains a PITA when people do trip over it. File operations that mess up contexts, use cases that don’t quite fit the policy, use cases that are well recognized but SELinux blocks it by default anyway until you change an sebool.
By being a security mechanism bolted on after the fact, various operations fail in ways that are mysterious because they can’t inject explanatory information into the failure path. Further the audit log that you pretty much always need to consult when something fails for mysterious reasons in case it might be SELinux isn’t even readable by the user that got dinged. So I can’t even code in a way to check if SELinux was the reason and guide the user, instead I have to provide a diagnostic utility they have to ‘sudo’ to explain to them, or be vague and say 'check if selinux is somehow involved. So I end up despite doing my damndest to not run with privilege asking users to run something with privilege to check a security mechanism.
The existence and usage of audit2allow is a big sign of problematic design. How to fix something you see in auditlog is hard for people to understand, so they just audit2allow to amend policy, but instead they should have done a chcon because now they have a crap rule allowing something they shouldn’t, but SELinux is still enabled so all good!
The whole label based concept is a fun whole other dimension of things for people to worry about. Messed up so often that we have a nice convenient ‘restorecon’ to basically apply the way AppArmor does things to the filesystem in that moment.
The curve could follow someone’s journey with complexity, starting out with the prejudice that SELinux is bad, then letting SELinux happen and noticing no issues, and then moving on to realms where they actually have to touch the goop of SELinux instead of the canned distro SELinux setup covering their use case.
Yeah, AppArmor is a lot more straightforward. I could buy an argument that technically the SELinux approach is more flexible, but it’s hard to imagine someone needing that much flexibility in the general use case.
I can understand why something like Android could get more mileage out of SELinux’ model, but most scenarios are very capably modeled by AppArmor approach and much easier and less fragile functionality wise.
You have two applications installed which bring their own labels and rules, lets say app_a_t and app_b_t.
Now you want to give AppA read access to only one specific directory of AppB data (which is labeled app_b_t).
How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for app_b_t.
My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).
While the stock policies have been refined to model more of an average user’s usage, the facility itself remains a PITA when people do trip over it. File operations that mess up contexts, use cases that don’t quite fit the policy, use cases that are well recognized but SELinux blocks it by default anyway until you change an sebool.
By being a security mechanism bolted on after the fact, various operations fail in ways that are mysterious because they can’t inject explanatory information into the failure path. Further the audit log that you pretty much always need to consult when something fails for mysterious reasons in case it might be SELinux isn’t even readable by the user that got dinged. So I can’t even code in a way to check if SELinux was the reason and guide the user, instead I have to provide a diagnostic utility they have to ‘sudo’ to explain to them, or be vague and say 'check if selinux is somehow involved. So I end up despite doing my damndest to not run with privilege asking users to run something with privilege to check a security mechanism.
The existence and usage of audit2allow is a big sign of problematic design. How to fix something you see in auditlog is hard for people to understand, so they just audit2allow to amend policy, but instead they should have done a
chconbecause now they have a crap rule allowing something they shouldn’t, but SELinux is still enabled so all good!The whole label based concept is a fun whole other dimension of things for people to worry about. Messed up so often that we have a nice convenient ‘restorecon’ to basically apply the way AppArmor does things to the filesystem in that moment.
The curve could follow someone’s journey with complexity, starting out with the prejudice that SELinux is bad, then letting SELinux happen and noticing no issues, and then moving on to realms where they actually have to touch the goop of SELinux instead of the canned distro SELinux setup covering their use case.
Over the last year I have done this entire. Went from app armor to SEL and now I’m back on app armor.
You couldn’t pay me enough to try SEL again.
Yeah, AppArmor is a lot more straightforward. I could buy an argument that technically the SELinux approach is more flexible, but it’s hard to imagine someone needing that much flexibility in the general use case.
I can understand why something like Android could get more mileage out of SELinux’ model, but most scenarios are very capably modeled by AppArmor approach and much easier and less fragile functionality wise.
In some usecases SELinux is less flexible:
You have two applications installed which bring their own labels and rules, lets say
app_a_tandapp_b_t. Now you want to give AppA read access to only one specific directory of AppB data (which is labeledapp_b_t).How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for
app_b_t.My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).