Re:SELinux Bypasses
by ruthmarx on Friday October 25, 2024 @06:39PM
(#41950567)
You are being downvoted but this answer is exactly right. It's kind of like complaining about group policy in Windows.
[ Parent
| on HN ]
Re:SELinux Bypasses
by orbisvicis on Friday October 25, 2024 @07:36PM
(#41951065)
That's exactly right - RH is windozifying Linux.
So is Ubuntu, so is any distro with systemd.
The point though, was if you don't want to learn to use a complex system you shouldn't complain when you use it and don't understand it.
Re:SELinux Bypasses
by orbisvicis on Friday October 25, 2024 @08:41PM
(#41951529)
RH is doing a lot of good things like unifying the NetworkManager configuration for plugins. But some things give me pause, such as - and it's been a while so I don't quite remember - copying ssh key selection settings to a security policy file elsewhere such that those settings in the regular config would be ignored. These are ssh-specific settings that did not integrate into a global "policy", and which were placed in a nonstandard location - not ssh.d, which now that I think about it is probably another RH invention.
Re:SELinux Bypasses
by worthless-trash on Saturday October 26, 2024 @12:05AM
(#41952459)
I think that's the crypto policy configuration which was required for some government certification iirc. It's been a while but I ran into this too.
There was a document on access.redhat.com that talked about it.
> But some things give me pause, such as - and it's been a while so I don't quite remember - copying ssh key selection settings to a security policy file elsewhere such that those settings in the regular config would be ignored.
Yeah, I've always been against that type of crap.
It's why Ubuntu, even Debian, and especially RedHat were never really viable distros for me when things like Slackware, Alpine and Void exist.
I don't need a ton of abstraction between me and what I'm trying to accomplish.
Similarly, how having systemd-resolved running overrides /etc/resolv.conf. Pretty annoying.
Annoying until you learn to disable it or learn what it is good for and how to configure it so that it will work for you.
It's annoying because it's a change in system that you are familiar with and you can trip on it you if you are not familiar with it, not because it is not useful or great challenge to configure right.