SELinux is unmanageable; just turn it off if it gets in your way

Re:SELinux is unmanageable; just turn it off if it gets in y... by raesene9 on Wednesday April 27, 2022 @02:56AM (#31177081)

I'd generally agree with this, but for production use (where it'll be CRI-O or ContainerD in all likelihood) it's worth noting that using containers does increase your attack surface.

We've had container breakout CVEs in the Kernel+ContainerD+CRI-O this year, and the ContainerD/CRI-O ones were not complex at all, so you do need to stay on top of patching as well as the other good practices mentioned.

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by bonzini on Wednesday April 27, 2022 @01:41PM (#31183232)

A lot the container breakout CVEs do not affect a system that uses SELinux properly.

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by raesene9 on Thursday April 28, 2022 @03:21AM (#31189648)

have you seen an analysis of SELinux against the recent set of breakouts? That'd be interesting to see.

Definitely the CRI-O one (which is most likely to affect Red Hat based systems) was able to exploit a default OpenShift cluster in my testing.

[ Parent | on HN ]