this vastly over sells SELinux. In past I would have said please provide a list of CVEs actually mitigated by default SELinux policy, and conveniently enough Red Hat just posted an article https://access.redhat.com/solutions/7032454 TLDR there’s 6 CVEs mitigated by SELinux in 10 years. That’s less than 1% of the CVEs fixed in RHEL.
SELinux is needed by entities like the US DoD and NSA, https://www.nsa.gov/portals/75/documents/what-we-do/research/selinux/documentation/presentations/2005-flexible-support-for-security-policies-into-linux-os-presentation.pdf and was invented in an era to solve problems, but largely do not exist anymore, or rather if you run software in containers, like most of the world issues largely go away.
App armor is about as ineffective as SELinux and again from an error, where the correct answer to a lot of this is to use things like containers and more modern solutions.
Unfortunately, a lot of my old writing from 25 years ago is no longer available on the Internet, but the basic point I would make is that Lennox and armor are 25 year-old solutions to a world that has changed significantly.
kurtseifried
npub106…zeaeu
2024-09-05 17:34:09 UTC
in reply to nevent1q…u82a
Author Public Key
npub1063rn8w9d4cv0f7nhgefy37ayase2k3g5j4ja3vsw3vkc66asnlqazeaeuPublished at
2024-09-05 17:34:09 UTCEvent JSON
{
"id": "e2e306a6cbf75c09996b340caaae86d3ba449463ebca9e7a2fe1780134d02eef",
"pubkey": "7ea2399dc56d70c7a7d3ba329247dd2761955a28a4ab2ec59074596c6b5d84fe",
"created_at": 1725557649,
"kind": 1,
"tags": [
[
"p",
"3cb00c9f87bad22eef7cd50d5d8f257f2b3d5c40e1a307c17e6b3fb4e43caddd"
],
[
"e",
"031152667d4b85548b2ed5d6e6ce3e74d7ae6409657784706719baebfd6e889a",
"",
"root",
"3cb00c9f87bad22eef7cd50d5d8f257f2b3d5c40e1a307c17e6b3fb4e43caddd"
],
[
"proxy",
"https://infosec.exchange/@kurtseifried/113086146127528222",
"web"
],
[
"proxy",
"https://infosec.exchange/users/kurtseifried/statuses/113086146127528222",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/kurtseifried/statuses/113086146127528222",
"pink.momostr"
],
[
"-"
]
],
"content": "this vastly over sells SELinux. In past I would have said please provide a list of CVEs actually mitigated by default SELinux policy, and conveniently enough Red Hat just posted an article https://access.redhat.com/solutions/7032454 TLDR there’s 6 CVEs mitigated by SELinux in 10 years. That’s less than 1% of the CVEs fixed in RHEL. \n\nSELinux is needed by entities like the US DoD and NSA, https://www.nsa.gov/portals/75/documents/what-we-do/research/selinux/documentation/presentations/2005-flexible-support-for-security-policies-into-linux-os-presentation.pdf and was invented in an era to solve problems, but largely do not exist anymore, or rather if you run software in containers, like most of the world issues largely go away. \n\nApp armor is about as ineffective as SELinux and again from an error, where the correct answer to a lot of this is to use things like containers and more modern solutions.\n\nUnfortunately, a lot of my old writing from 25 years ago is no longer available on the Internet, but the basic point I would make is that Lennox and armor are 25 year-old solutions to a world that has changed significantly.",
"sig": "4eac78ea8a899950d30c32da0123abace48948757d0ec279dd3d5f1c3d7602be3fd0879d9b4cbf73b6a48ad74a7f7bbe8c2d5d03534f565a5420c0416e7997d0"
}