Title.
I’ve encountered it very little, but when I encounter it it’s because I try to do something and it doesn’t work. So I check the permissions with
ls -l, and it all seems reasonable. Huh, this should work. Try again, nope. Hmm. 20 minutes of trying random variations, strange results. Oh fuck, is this SELinux? Shit. Where do those configs exist again? How do I configure that? Google “SELinux cheat sheet” hmmm, I don’t have enough context to use that, Google “SELinux getting started”. Read tutorial, try to skim just enough to figure out what’s going wrong for me.So I don’t hate it, I just haven’t ever had a use for it, but it has surprised me in a bad way before and cost me a lot of time and confusion, but I’ve never spent the time getting familiar because I’ve never had a use for it. And it comes up rarely enough I never remember anything about it by the time it bites me. I can’t even recall now what I was trying to do the last time I bumped into it.
Absolutely this.
33 years in Linux, 30+ professionally, Unix+Linux security background in a past life at a fucking distro.
When I first install a new distro version, I do something very simple; maybe I configure a simple web page, for instance.
Usually the web server refuses to start, or something equally “so dumb it should have been seen in early testing and doesn’t even get to the challenge I set before it” stupid. If the distro can’t test something so basic, then I know they’re not prepared to consider selinux implications while maintaining or debugging the distro. I don’t need to blaze a trail the distro can’t be arsed to.
Then I mod away the config in my template and hope the distro can pull out their proverbial head in 5 years.
The easiest path needs to be the safest path
It’s an unnecessary layer of complexity. I am the only user of my personal laptop. I don’t need fine-grained permissions. Linux users and groups are enough for any permission needs I might have, like docker group, audio and video groups, etc. I don’t have any “classified” documents on my computer. My home directory and root are on different disks. I can easily format and reinstall my system if something goes wrong and keep all my personal data.
You don’t have classified documents, but you probably use bank in your browser running as your user. Maybe you use local mail program to send emails, also running as your user. A simple malware could add emails to be send asking your family to send you some money through online service.
And that’s easily done because the only isolation layer is user and group.
Not everyone does online banking (I don’t), and it’s possible to warn your family about scams. If the information isn’t there, you don’t need to lock it down. Of course, that just moves both the security and the accompanying inconvenience off the computer and into the real world.
I really don’t see how anyone can install malware on my computer. I know my way around computers enough to not do anything dumb. Of course if someone wanted, they would be able to hack my device, probably. But I am not a high value target and it would be a waste of their time and effort. In short, that’s a risk I am willing to take :)
Plain and simple, with a supply chain attack.
Yes. That’s fair. It’s an actual, realistic threat. But personally, I don’t provide any services to anyone and my data is periodically backed up to my NAS and cloud. But that’s me. I can imagine other scenarios that would definitely require SELinux.
Your data can be encrypted with a ransomware attack. Including your backups. Your memory searched for browser cached passwords and account names.
You’re not with the effort? The effort is practically 0 these days. Bots written by AI don’t care. And your compute resources can be used to do more harm.
Having your home directory on a different disk is something that could’ve saved me a lot of headache. Can’t believe I didn’t think of that.
In a lot of distros at least, you can just reinstall in place, which has the same effect. But a different place for /home does feel a potentially more reliable method.
I think it’s becoming default on more and more Linux installers
It used to be. I think it changed at some point to make installs easier for new people who were used to only having a single C:.
Linux permissions are obvious, straightforward, and very easy to change - They rule.
SELinux permissions are impossible to see, seemingly pointlessly more complex, and I don’t know how to check them or change them i.e. They drool.
As a power user who is constantly changing system stuff, installing weird stuff, running weird servers, disabling SELinux is like, step 2 of installing Linux for me (and honestly, even if you’re not a power user, I can assure you at least ONE issue you’ve faced was actually caused by SELinux under the hood). I have wasted whole days working out just that SELinux is causing my fucking issue, and then days more on how to fix the permissions, and then days more doing those again when those permissions RESET as it is wont to do and days more trying to make my needed changes permanent. And let’s not even get started on how to transplant an SELinux permissions structure from one disk to another. So instead of a week’s worth of frustrating work every year, I can spend one minute disabling SELinux.
Its implementation feels contradictory to the most basic principles of understandable and workable systems. It’s like the NSA wanted to make software that was the diametric opposite of the Zen of Python. It’s ugly, it’s implicit, it’s complicated, nested, dense, unreadable, full of special cases, and silent errors, it constantly guesses in the face of ambiguity (which is why I have to constantly correct it).
Basically, I have wasted too much of my life faffing with an opaque and ludicrously complex permissions layer that seems to be there solely as a ‘just in case’ my already existing permissions aren’t good enough.
Honestly I am kind of afraid of Linux still. I hide inside Emacs. These eorts of tips are really helpful.
If you’re just doing normal sheet, you should ideally basically not even notice SELinux. And in that sense it’s good.
If you’re doing any dev or running any server software or some kind of freaky setup, my advice is disable it. At least all you have to do is turn a true into a false.
For 2 years, I had to set up production environments on RHEL, mostly Apache and Keycloak servers. I had a limited, very specific list of sudo permissions, and I had to ask very specifically what I else needed, which was then granted by people who neither knew nor cared what I was working on.
SELinux permission problems were always the fallback reason when nothing else made sense. With my permissions, I could not just straight up check for it. E. g. Apache would not server a folder, cryptic error -> check file permissions -> check general Apache config problems -> assume SELinux permission is missing and request it, supplying the exact command they need to type.
It’s awesome, but very complicated to use and overkill for most homegamer setups.
The first interaction most people have with it is when it stops something they want to do from working and it’s not obvious why. Then the first selinux command they learn is how to disable it.
If you’re mandated or regulated to implement MLS or MAC etc, SELinux is a security control that enables you to comply through expanded and expressive policy controls.
When I hear dislike for it, it’s usually because people are using SELinux as a “make my personal computer safer” tool rather than the “we’ve hundreds of thousands of differently classified sensitive documents and thousands of employees with different clearances”.
MAC/DAC/MLS isn’t designed for personal computing and if you think SELinux is the solution you personally need, you might need to reevaluate your threat model (as any external actor will seek to bypass kernel controls entirely e.g. CVE-2025-0078).
Excessive for my threat model, one more thing which could break something (even if by no fault of its own).
I like it as a concept, but many of my devices don’t use it.
Why do people security- and privacy-focused people distrust NSALinux? Well boy howdy, that’s a tough question that isn’t answered by looking at the project’s origins.
It’s a pain in the ass when you want to run a web server on your PC. You have to disable SELINUX else the damn thing won’t let me modify html pages and show the updates. Everything is just frozen from making any changes. That said, it’s probably easier to do web development another way, my method is nearly two decades obsolete. SELINUX really pissed me off though. I wanted to test forum software on my PC once, and SELINUX was blocking me and I couldn’t figure it out for ages.
Always seemed way too enterprisy for my taste.
After switching between distros for 8+ years and settling on Fedora KDE, I don’t think I’ve ever had SELinux get in my way for anything.
Who said that? I really like it.
Never used it, but i think that’s also because it doesn’t work on distros without systemd. So i guess that’s a reason to dislike it?
Wut? No.
So it does work fully on distros without systemd? The distros i’ve tried so far either have no support or limited support, so i assumed it to have something to do with lack of systemd. They usually rely on apparmor instead.
Gentoo doesn’t indicate there would be any issue with installing SELinux on an OpenRC system, and I can’t see anything anywhere that suggests the requirements differ by init system.
It’s a kernel feature with some user-space utilities.
It also seems to be a “RedHat” thing primarily - Debian systems tend to prefer apparmor. You may have been noticing that instead?
That must be it then, in that case i was talking out of my ass lol. From what i remember Void linux doesn’t mention selinux at all in the handbook. Now i’m using Guix and decided to check the documentation, they do support it but it has limitations it seems. Never bothered to look into selinux when i was still on systemd distros, so i mistakenly assumed it had something to do with that.
