What reasons do people have for disliking SELinux?
2026-05-28 06:49 UTC
Replies (22)
-
@kureta@lemmy.ml 2026-05-28 07:00
It’s an unnecessary layer of complexity. I am the only user of my personal laptop. I don’t need fine-grained permissions. Linux users and groups are enough for any permission needs I might have, like docker group, audio and video groups, etc. I don’t have any “classified” documents on my computer. My home directory and root are on different disks. I can easily format and reinstall my system if something goes wrong and keep all my personal data.
-
@fozid@feddit.uk 2026-05-28 07:13
I don’t dislike it. I have no opinion on it. It’s something I have never looked into heavily enough as it has never been a potential solution to a problem I may have encountered. There are no security or hardening areas that I currently class as gaps that need plugging in any of my systems where I would consider looking into selinux.
-
@hendrik@palaver.p3x.de 2026-05-28 07:20
Uh. I guess people have random opinions and blast them on the internet. I can see how someone would misconfigure their computer and then blame it on the software. Or use software they don’t need, which just adds unnecessary complexity and more issues. Other than that, I don’t think there’s anything wrong with SELinux.
-
@Thordros@hexbear.net 2026-05-28 08:05
Why do people security- and privacy-focused people distrust NSALinux? Well boy howdy, that’s a tough question that isn’t answered by looking at the project’s origins.
-
@CallMeAl@piefed.zip 2026-05-28 08:16
I no reasons for disliking it. SELinux is an incredibly powerful security tool.
-
@dwt@feddit.org 2026-05-28 09:04
I Like the idea, But the Implantation ist complicated enough, that it Acts as a high Barrier to entry
-
@ChristchurchAsshole@lemmy.ml 2026-05-28 09:57
It’s a pain in the ass when you want to run a web server on your PC. You have to disable SELINUX else the damn thing won’t let me modify html pages and show the updates. Everything is just frozen from making any changes. That said, it’s probably easier to do web development another way, my method is nearly two decades obsolete. SELINUX really pissed me off though. I wanted to test forum software on my PC once, and SELINUX was blocking me and I couldn’t figure it out for ages.
-
@juipeltje@lemmy.world 2026-05-28 10:33
Never used it, but i think that’s also because it doesn’t work on distros without systemd. So i guess that’s a reason to dislike it?
-
@Soot@hexbear.net 2026-05-28 10:46
Linux permissions are obviously, straightforward, and very easy to change - They rule. SELinux permissions are impossible to see, seemingly pointlessly more complex, and I don’t know how to check them or change them i.e. They drool. As a power user who is constantly changing system stuff, installing weird stuff, running weird servers, disabling SELinux is like, step 2 of installing Linux for me. I have wasted whole days working out just that SELinux is causing my fucking issue, and then days more on how to fix the permissions, and then days more when those permissions RESET as it is wont to do and days more trying to make my needed changes permanent. Basically, I have wasted too much of my life faffing with a permissions layer that seems to be there solely as a ‘just in case’ my already existing permissions aren’t good enough.
-
@ISolox@lemmy.world 2026-05-28 12:06
After switching between distros for 8+ years and settling on Fedora KDE, I don’t think I’ve ever had SELinux get in my way for anything.
-
@psycotica0@lemmy.ca 2026-05-28 12:09
I’ve encountered it very little, but when I encounter it it’s because I try to do something and it doesn’t work. So I check the permissions with ls -l, and it all seems reasonable. Huh, this should work. Try again, nope. Hmm. 20 minutes of trying random variations, strange results. Oh fuck, is this SELinux? Shit. Where do those configs exist again? How do I configure that? Google “SELinux cheat sheet” hmmm, I don’t have enough context to use that, Google “SELinux getting started”. Read tutorial, try to skim just enough to figure out what’s going wrong for me. So I don’t hate it, I just haven’t ever had a use for it, but it has surprised me in a bad way before and cost me a lot of time and confusion, but I’ve never spent the time getting familiar because I’ve never had a use for it. And it comes up rarely enough I never remember anything about it by the time it bites me. I can’t even recall now what I was trying to do the last time I bumped into it.
-
@DanceMomsSavedMe@lemmy.zip 2026-05-28 12:48
It was made by the NSA so that’s already minus 5 points right there. I’m not kidding. Look it up on DDG.
-
@mech@feddit.org 2026-05-28 14:08
I’m a sysadmin and I don’t understand it, so I just set it to permissive so it doesn’t interfere. The machine is behind a firewall anyway so it’s safe.
-
@chgxvjh@hexbear.net 2026-05-28 14:28
Always seemed way too enterprisy for my taste.
-
@moonpiedumplings@programming.dev 2026-05-28 16:26
It’s extraordinarily complex. The reality is that security is not just technical implementation, but also actually getting people to use the solutions. “Stop disabling SELinux” is not a real answer to when people disable it, like we have one person in this thread. Another problem with complex security solutions is they are hard to get right. Even if you enable them and configure them, without being an expert, it’s possible you left a gap here or there, and holes and gaps in these solutions.* Like so many other complex linux security solutions, it is lacking effectiveness due to still sharing the same kernel. There is a good, but bit dated writeup here about the problems with Linux security, from an architecturual perspective: madaidans-insecurities.github.io/linux.html . But, the short version is that the Linux kernel is large and complex, and has a lot of attack surface. And it’s a frequent source of vulnerabilities because attackers can hit it as long as they access to the kernel, even if they are in a container/sandbox. Like, copyfail and dirtyfrag would punch through containers, but also punch through SELinux. For example, just earlier on lemmy someone dropped a zero day that punches through SELinux: programming.dev/post/51103657 Now, SELinux can be used to restrict what a root shell could do after escalating… but that’s further complexity you have to learn to configure, and configure it correctly as well. Ultimately, none of the Linux security solutions come anywhere near the isolation of simply running something in a virtual machine. Which, also happens to be a lot simpler and actually possible to get people to use. *(putting this at the bottom because it veers off topic) I have a greater argument and problem with mentalities like this. I have noticed a pattern, where many of the more effortfull and toil intensive security solutions are recommended by people who have the time, energy, and skills to execute them. They have a bias/blindspot to the realities, which is that not everyone is in the same situation as them. For example, updating/patching software. Linux distros like RHEL or Debian, have a policy where they only do security updates, and don’t do feature updates or bugfixes. This enables them to ship automatic updates, so that security issues are automatically handled. On the other hand software like Windows, likes to bundle in breaking changes along with security updates. So automatic updates get disabled because “They might break something”. And then, people don’t update them, and environments get horrifically out of date, because not enough money/time/people is put into regular IT people who are in charge of maintaining them. But some environments, have heroes, people who go around patching everything and keeping everything up to date and secure. And when they see these environments that don’t have everything patched, they usually give the advice of “You should patch everything” (while simultaneously advising against auto updates), not understanding that these environments are lacking a key ingredient: Themselves. Sure, I could be a hero. I could “patch” everything manually. I could deploy SELinux. But that would only last until I get burnt out, or leave. Once I’m gone, SELinux, the patches, any similar security solutions are gone. I’ve met so many people, even in cybersecurity, that are apathetic about security, even though they might have cared once upon a time.
-
@uuj8za@piefed.social 2026-05-28 16:52
It made it harder for me to install Guix.
-
@atzanteol@sh.itjust.works 2026-05-28 12:25
It’s awesome, but very complicated to use and overkill for most homegamer setups. The first interaction most people have with it is when it stops something they want to do from working and it’s not obvious why. Then the first selinux command they learn is how to disable it.
-
@swelter_spark@reddthat.com 2026-05-29 00:39
I’m more familiar with AppArmor, and my distro’s forum gives the impression that switching involves a lot of configuration to get things working as expected…which, AppArmor did too, but I’ve done that already. Next time I install, I might try SELinux.
-
@wulrus@lemmy.world 2026-05-29 07:27
For 2 years, I had to set up production environments on RHEL, mostly Apache and Keycloak servers. I had a limited, very specific list of sudo permissions, and I had to ask very specifically what I else needed, which was then granted by people who neither knew nor cared what I was working on. SELinux permission problems were always the fallback reason when nothing else made sense. With my permissions, I could not just straight up check for it. E. g. Apache would not server a folder, cryptic error -> check file permissions -> check general Apache config problems -> assume SELinux permission is missing and request it, supplying the exact command they need to type.
-
@comfy@lemmy.ml 2026-05-29 10:34
Excessive for my threat model, one more thing which could break something (even if by no fault of its own). I like it, but many of my devices don’t use it.
-
@20log10@piefed.world 2026-06-02 12:22
I see people here saying it’s complicated and not suitable for home use. But what is suitable for home use? AppArmor? Something else? Nothing?
-
@lambalicious@lemmy.sdf.org 2026-06-18 00:27
Back in the time when I disliked it and, to a lesser extent, AppArmor, the reason was pretty simple: It forces services to lie to me / It gets in the way of software doing what I tell it to do. The examples would be rather simple. Need to spin up a second instance of a database server, sure, just set up the given config file with datadir=/mount/point/second/disk/var/lib/database. Should work… Nope. Database errors out despite the directory existing and being writable and all permissions being right. Insists it’s “file permissions”. Try to look around, to no end. Then it turns out there is some secret NSA Cabal infiltrated in my server already that… for some weird reason, forces databases to be installed on /var/lib even though when that is almost full and I mounted a second disk to have more room. And thus the service lies to me, says file permissions, well I checked them several times and they were alright. Stupid NSA cabal thing stupidly getting in the way of configuring things and adding more entrypoints you have to edit and services you have to configure just to start up a program. I want to start a database, not set up a DEFCON 1 line! Those days I was beginning to miss SQLite already… Similar issues I had with webservers, network share servers, joysticks and gamepads, and even audio devices. Never got a clear idea of what it was, software says something like “permission error” or “not a device file” but I checked and those are alright. A long sigh, remember than when you install a server you have to disable SELinux and AppArmor and reboot, boom, done, everything magically works. Fortunately things have improved a long way since, but back in the day, they were one of the most grating obstacles to me for getting friends, let alone clients, to adopt Linux.