Security enthusiasts wanted: from beginners up to SELinux experts to make up the SELinux "Confined Users (SIG)" to foster Fedora's security capabilities
discussion.fedoraproject.org
SELinux provides a strong security measure that can make an SELinux-enabled operating system a type of “fortress”: the so-called “confined users” [1] [2] [3], which add security and isolation capabilities that are in several respects comparable to containers but without many of their restrictions in GUI use cases (this topic is focused on desktop use cases, not server, infra, and such). By default, SELinux does not enforce much within user accounts but only around them. But in graphical desktop...
    • eeleech@lemm.ee
      13·
      1 year ago

      afaik yes, at least the arch kernel has selinux enabled, but you need to install the user space tools from the AUR.

    • Sh1nyM3t4l4ss@lemmy.world
      5·
      1 year ago

      I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.

      I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.

      • Baut [she/her] auf.@lemmy.blahaj.zone
        7·
        1 year ago

        Nitpick: it’s not that AppArmor isn’t as secure, it’s just that SELinux is more powerful. The security always is up to the profiles.
        If you were to compare the policies for Fedora and e.g. Debian, I would assume Fedora has better ones though lol

        • ladyanita22@lemmy.world
          3·
          1 year ago

          For sure. I believe Debian’s AppArmor integration is a little bit of an afterthought and there’s lots of patches missing as Canonical likes to keep many improvements downstream.