I'm. amuxh bigger fan of apparmor. Easier to configure, easier to debug, easier to fix, and as far as I know it gives the same level of security
this post was submitted on 03 Nov 2026
108 points (88.0% liked)
linuxmemes
33305 readers
331 users here now
Hint: :q!
Sister communities:
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack users for any reason. This includes using blanket terms, like "every user of thing".
- Don't get baited into back-and-forth insults. We are not animals.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry of any kind will not be tolerated. This is an LGBTQ+-friendly community -- if that is a problem for you, you should leave.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn, no politics, no trolling or ragebaiting.
- Don't come looking for advice, this is not the right community.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, <loves / tolerates / hates> systemd, and wants to interject for a moment. You can stop now.
5. π¬π§ Language/ΡΠ·ΡΠΊ/Sprache
- This is primarily an English-speaking community. π¬π§π¦πΊπΊπΈ
- Comments written in other languages are allowed.
- The substance of a post should be comprehensible for people who only speak English.
- Titles and post bodies written in other languages will be allowed, but only as long as the above rule is observed.
6. (NEW!) Regarding public figures
We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations. - Keep discussions polite and free of disparagement.
- We are never in possession of all of the facts. Defamatory comments will not be tolerated.
- Discussions that get too heated will be locked and offending comments removed. Β
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
founded 3 years ago
MODERATORS
Selinux is both a pillar of security & a pain in my ass.
is this the thread where we add "in the ass" to common knowledge?
a pillar in your ass
Sounds like a pain
Without lubricant that is
Yeah, that's how just about everything in security goes. I find policyd to be far more annoying.
Skill issue
android uses selinux and android is used as the base for one of the most secure OSes in the world.
if you mean GrapheneOS, you can't not know that GrapheneOS's security is thanks almost in no part to SELinux
Android is not, and never was, secure. Selinux is a bandaid.
selinux has, is, and will always be a fucking pain in the ass for us custom rommers
It's both. If you have a deployment where everything works and you didn't have to disable it or restrict it a lot then obviously it's very good to have. The problem is with reaching this state where everything works and selinux is also enabled.
i have never bothered learning what se linux even is
Why is it bad?
Because developers are bad at using it. How many times have you seen a installation instructions telling you to turn it off
More than once, now that I think about it
selinux relies on the basis of deny all, allow only ideas. On paper that's fine, but when you are troubleshooting issues, installing software or developing applications, it can hinder productivity by preventing the user from doing things.
Selinux CAN work, but it absolutely requires a lot of time investment and maintenance to keep it working well with audit.d and general logging.
I might get down voted for this, but I've honestly found LLMs pretty useful tools for debugging SELinux.
git gud
git: 'gud' is not a git command. See 'git --help'.
The most similar command is
guiI love this. First time seeing it.
selinux relies on the basis of deny all, allow only ideas
Only in enforced.
but when you are troubleshooting issues, ,
Just set setenforce 0 for this
installing software or developing applications
for this see policy log and create selinux policy with generator if developer was lazy
it can hinder productivity by preventing the user from doing things
Highter productivicy before someone still all your code (like binance)
So the correct way to use SELinux is to checks notes disable it
I wish I could set up SELinux but NixOS doesn't support it... I already do something similar where all files on root are wiped by default (E: on each boot) and I have to opt things into persistence so it's definitely something that I'd like.
Because apparently people are stuck in the mindset of about 10 years ago when people used to get tripped up over it. SELinux is rarely ever a problem for anything these days. This post is dumb.
While the stock policies have been refined to model more of an average user's usage, the facility itself remains a PITA when people do trip over it. File operations that mess up contexts, use cases that don't quite fit the policy, use cases that are well recognized but SELinux blocks it by default anyway until you change an sebool.
By being a security mechanism bolted on after the fact, various operations fail in ways that are mysterious because they can't inject explanatory information into the failure path. Further the audit log that you pretty much always need to consult when something fails for mysterious reasons in case it might be SELinux isn't even readable by the user that got dinged. So I can't even code in a way to check if SELinux was the reason and guide the user, instead I have to provide a diagnostic utility they have to 'sudo' to explain to them, or be vague and say 'check if selinux is somehow involved. So I end up despite doing my damndest to not run with privilege asking users to run something with privilege to check a security mechanism.
The existence and usage of audit2allow is a big sign of problematic design. How to fix something you see in auditlog is hard for people to understand, so they just audit2allow to amend policy, but instead they should have done a chcon because now they have a crap rule allowing something they shouldn't, but SELinux is still enabled so all good!
The whole label based concept is a fun whole other dimension of things for people to worry about. Messed up so often that we have a nice convenient 'restorecon' to basically apply the way AppArmor does things to the filesystem in that moment.
The curve could follow someone's journey with complexity, starting out with the prejudice that SELinux is bad, then letting SELinux happen and noticing no issues, and then moving on to realms where they actually have to touch the goop of SELinux instead of the canned distro SELinux setup covering their use case.
Over the last year I have done this entire. Went from app armor to SEL and now I'm back on app armor.
You couldn't pay me enough to try SEL again.
Yeah, AppArmor is a lot more straightforward. I could buy an argument that technically the SELinux approach is more flexible, but it's hard to imagine someone needing that much flexibility in the general use case.
I can understand why something like Android could get more mileage out of SELinux' model, but most scenarios are very capably modeled by AppArmor approach and much easier and less fragile functionality wise.
It assumes the user is an idiot. And it assumes the user should not own their own device.
That is the core tenant of how it works.
Aka deny all base line.
tenet
SELinux glows in the dark
Selinux is the pillar of security.
A hill to die on: AppAmor is better for most user setups.
I have come to the general understanding that unless you have a million dollars on the line and a million more dollars to give to one person to manage it.
Just use app armor
I am still near the middle π