Re:The SELinux coloring book [pdf]
by djsumdog on Friday March 03, 2017 @12:52PM
(#13784634)
AppArmor took some time to understand, but it wasn't too bad. I've written AppArmor profiles for in-house apps. I realize AppArmor isn't as powerful as SELinux, but I do find it easier to understand.
I feel like having to worry about complex SELinux configuration isn't going to matter as much for people who start to use containers. Most distributions have SELinux profiles for docker that work, and containers provide a decent level of isolation.
They're not as good as full VMs, and a kernel exploit can still break out of a container, but if you're running all your own in house/trusted code on your container system, it seems like a pretty good trade-off for isolation/security.
I feel like having to worry about complex SELinux configuration isn't going to matter as much for people who start to use containers. Most distributions have SELinux profiles for docker that work, and containers provide a decent level of isolation.
They're not as good as full VMs, and a kernel exploit can still break out of a container, but if you're running all your own in house/trusted code on your container system, it seems like a pretty good trade-off for isolation/security.