Hacker News Reader

Comment by tubularhells | Hacker News Reader

SE Linux is enabled by default in Debian, Ubuntu, Fedora and Manjaro (iirc), so I stopped reading at the introduction. The exploit presupposes the lack of this basic hardening.

View on HN

Of those distributions, only Fedora sets SELinux to enforcing by default. Moreover, AFAIK Fedora (and RHEL) are the only distributions that had wide-scale testing of the reference policy [1] [2]. So, if you enable SELinux with the reference policy on the other distributions that you mention, it is likely that you will run into all kinds of issues.

[1] https://github.com/SELinuxProject/refpolicy

[2] https://github.com/fedora-selinux/selinux-policy

Every day I become more and more of the opinion that Fedora/RHEL are the only distros that are actually worth using. I recently installed ubuntu server to see what it was like compared to fedora server and was shocked to see that the python package still links to python 2 (!) despite it already being officially discontinued.

Fedora Silverblue/CoreOS look like a massive step in the right direction which no other mainstream distros are working on.

Fedora also seems to be the only distro willing to set sane defaults for everything (SELinux, Wayland, CGroupsV2, soon to be pipewire, python 3) while every other distro waits around for someone else to make the first move.

> I recently installed ubuntu server to see what it was like compared to fedora server and was shocked to see that the python package still links to python 2 (!) despite it already being officially discontinued.

How recently? Ubuntu 20.04 dropped python 2 completely.

Installed it in the second quarter of 2020 but I just checked my isos folder and it looks like I have ubuntu server 19.10. Good to see python 2 finally kicked out.

I'm not sure how it helps here. User-level access in enough, isn't it?

SELinux is more fine-grained than user-level access: it implements application-level access. Even if you, as a user, can access a file, an application working on your behalf cannot do so; same for launching applications.

Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due to the SELinux policies on the machine:

https://www.coker.com.au/selinux/play.html

It is.

for debian and ubuntu i think you meant apparmor not selinux

except for fedora they don't support selinux well

Reply on news.ycombinator.com