KernelTrap offers a summary of a lengthy debate on OpenBSD's -misc mailing list comparing the security features built into OpenBSD versus the security offered by the Linux kernel's SELinux feature. The main arguments presented against SELinux centered around its complexity and the difficulty of defining a secure policy. "The first thing people usually do with SELinux is turn it off", suggests the article, noting that the ease with which it can be turned off is another security shortcoming. By contrast, OpenBSD offers numerous security features that are always enabled with minimal overhead, including propolice stack protection, random library mappings, proactive privilege separation, W^X, and systrace.
To read all comments associated with this story, please click here.
Member since:2006-08-01
> and is MUCH MUCH MUCH more easy to use.
I really don't care.
I use Fedora, SeLinux is enabled and I don't touch SeLinux policy. My OS should be secure, I don't have to make it secure.
If i manually install a program and it trigger SeLinux policy, then I remove this program because this program should have security flaw. Period.
This only appened one time. Many many many programs work out of the box with SeLinux enabled. Some not but they are a very few number.
Member since:2005-07-06
While I agree that Apparmor is easy to to use and configure, there are a number of (in my opinion valid) critisisms leveled against it. On the whole it is not as solid a sollution as SELinux.
Personally I don't currently need the sort of security that SELinux offers, and as such I'm quite happy doing things the 'old' way (I run OpenBSD and Debian on a couple of servers). However if I needed the type of features SELinux offered then I would take the time to learn SELinux and do it right. AppArmor seems to fill some kind of in between niche that no one really needs.
Member since:2006-01-10
Member since:2006-01-07
It's my understanding that apparmor is going to be implemented in the upcoming Ubuntu release:
https://wiki.ubuntu.com/AppArmor
But yes, I tip my hat to SUSE for being the first to do this.
Member since:2005-11-12
Member since:
2007-04-21
I think everyone is looking at this all wrong.
SELinux is too hard, but the security framework itself is very good.
I'm still amazed that SUSE is the only distribution to include Apparmor http://www.novell.com/linux/security/apparmor/
It is also "open source" and uses the linux security framework and is MUCH MUCH MUCH more easy to use.
Darren