• 0 Posts
  • 18 Comments
Joined 1 month ago
cake
Cake day: February 17th, 2025

help-circle

  • unhrpetby@sh.itjust.workstoLinux@lemmy.mlWhy do we hate SELinux?
    link
    fedilink
    English
    arrow-up
    26
    ·
    edit-2
    1 day ago

    Security is much more effective and adopted when it is simple. My understanding is that SELinux is not.

    This means not only will fewer people use it and more people turn it off if something doesn’t work, it means more people are at risk of misconfiguring their system to allow something they didn’t intend to.

    This is somewhat mitigated from the fact that, from my experience, Linux Security Modules cant ever make you less secure than without it. But it still can provide a false sense of security if you misconfigure it.

    Here is a good article showing what I am referring to, and providing a solid security tool: BSD pledge/unveil on Linux.





  • It can be done if you mess with the initramfs.

    The kernel starts everything else by unpacking an archive containing a minimal environment to set stuff up for later. Such as loading needed kernel modules, decrypting your drive, etc. It then launches, by default, the /init program (mines a shell script).

    That program is PID 1. If it dies, your kernel will panic.

    After it finishes setup, it execs your actual /sbin/init. These means it dies, and that program (systemd, openrc, dinit, runit, etc) becomes PID 1. If an issue happens, both could fail to execute and the kernel will loop forever.