News for hackers. Stuff that matters.

A comment on Stealthy Linux rootkit found in the wild after going undetected for 2 years. Parent comment

Re:Stealthy Linux rootkit found in the wild after going unde... by hollerith on Sunday December 10, 2023 @09:30AM (#38591713)
>people will disable SELinux the moment their distro boots first time, because that thing is just massive pain to use Linux with.

I think you mean secure boot: the only distros that even try to enable SELinux are Fedora and Red Hat, and on those distros SELinux gets in the way only very rarely. (Source: I am a user of Fedora and Red Hat.)

[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by izzdrasil on Sunday December 10, 2023 @10:32AM (#38592176)
They definitely mean selinux. There only needs to be a single issue for an average user to disable selinux.
[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by hollerith on Sunday December 10, 2023 @11:10AM (#38592499)
I always thought that admins of Linux installs other than Fedora and Red Hat installs rarely bothered with selinux and that it is definitely not enabled on an initial install.

I thought selinux was available as a package on non-RH distros, but install it and enabling was very painful unless you are an selinux expert, so almost no one on those distros does.

Are you sure you don't mean AppArmor?

[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by freedomben on Sunday December 10, 2023 @12:34PM (#38593207)
I've been a fedora user and Red hat user since 2010, and worked at Red hat for a few years, though not on RHEL.

I think they did mean selinux. You are absolutely right that nowadays it just works for the most part. The big exception is for people deploying applications that don't have selinux config shipped by Red hat. Those people have to configure things properly, and rarely do people bother. If you do things like change the default ports for services, that can also get you in selinux trouble.

[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by nurettin on Sunday December 10, 2023 @04:12PM (#38595099)
That's it! I was just having trouble connecting to my local rmq server on a fresh fedora 39 install. Forgot to disable selinux!
[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by TheLoafOfBread on Sunday December 10, 2023 @02:18PM (#38594057)
No, I mean selinux. And when I was using Linux, selinux got in the way basically immediately.
[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by hollerith on Sunday December 10, 2023 @03:51PM (#38594918)
Interesting. On which distro?
[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by TheLoafOfBread on Sunday December 10, 2023 @05:11PM (#38595604)
Fedora if I remember correctly. It is few years back.
[ Parent | on HN ]