Is Fedora the only mainstream desktop distribution to ship with SELinux?
afaik yes, at least the arch kernel has selinux enabled, but you need to install the user space tools from the AUR.
But the profiles are pretty poor and basic AFAIK.
I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.
I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.
yeah, same. I am currently on NixOS, but looking to move away because it’s lacking support any MAC. I really love NixOS and it’s declarative approach to things, but i can’t live with such a large security hole in my home Network.
As soon as i find a Distro that has MAC and allows for at least semi-declarative configuration, i am switching. But being able to declare an env/dconf setting in my config and sync it across all devices is just too powerful
I suggest you check Silverblue + Ansible (or CoreOS/IoT for server stuff).
while i think that ansible is really cool, it’s not the same as Nix.
correct me if i’m wrong, but afaik Ansible just modifies the current state of the System with a declarative configuration.
Nix reverts your system back to install and then applies the configuration. The result is that in Nix if i remove something from the configuration.nix it is as if it never existed, whereas on Ansible it stays unless i manually run a task to uninstall it.
Maybe Opensuse?
From what I’ve found it’s not implemented by default.
SELinux has long suffered from usability issues. Many commercial software packages require SELinux be disabled.
Fix the docs, improve error messages, and create a GUI to improve usage.
deleted by creator
I agree, but I don’t expect software companies to support it without clear documentation.
deleted by creator
Recently a supplier of ours announced that we could finally host their shitty java app on Linux instead of paying fucking Oracle for Solaris. So we were eager to hear the requirements. It was RHEL 8.4 or something, a version that was already EOL at the time.
They can’t even update their distros apparently.
Hate to be the type of person to comment this, but patches more than welcome
for real though, even a small contribution to the docs helps a ton
SELinux will not magically make your system more secure. Desktop insecurity mostly boils down to poor user choices. E.g Granting vscode full access to your home folder and installing some random extension.
Flatpaks and similar “container” tools are the obvious tools to use if you care about desktop security which the Linux ecosystem still generally deems as a lesser priority over being able to gain “rootful” permissions to carry out administrative tasks.
Nothing will make your system magically more secure, but SELinux is of great help when properly set up (as is in the case of Fedora).
Anyone even slightly interested in this, join!
Seriously, I didn’t know jack about SELinux before joining the SIG and now I know a little less than jack about it (I tried confining my user and managed to be unable to login to my system)
I love it and it really makes my Desktop more secure. Switching it off, has lead to installing hostile or insecure software within months. When it was introduced, i felt controlled by it, but actually i saw, what a mess came out of it when i disabled that. Today i feel protected, out of eperience, even if i know shirt about how it exacly works, but i saw stupid software harming my system when it was disabled.
I am curious, do you have an example?
It was written by the NSA, that’s enough for me not to trust SELinux.
It’s open source and lots of eyeballs have looked at it.
It’s fine.
Maybe but there must be a reason 99% of distributions use AppArmor instead
AppArmor is less complicated. That’s the main reason
