selinux relies on the basis of deny all, allow only ideas. On paper that’s fine, but when you are troubleshooting issues, installing software or developing applications, it can hinder productivity by preventing the user from doing things.
Selinux CAN work, but it absolutely requires a lot of time investment and maintenance to keep it working well with audit.d and general logging.
I wish I could set up SELinux but NixOS doesn’t support it… I already do something similar where all files on root are wiped by default (E: on each boot) and I have to opt things into persistence so it’s definitely something that I’d like.
selinux relies on the basis of deny all, allow only ideas. On paper that’s fine, but when you are troubleshooting issues, installing software or developing applications, it can hinder productivity by preventing the user from doing things.
Selinux CAN work, but it absolutely requires a lot of time investment and maintenance to keep it working well with audit.d and general logging.
I might get down voted for this, but I’ve honestly found LLMs pretty useful tools for debugging SELinux.
git gud
git: ‘gud’ is not a git command. See ‘git --help’.
The most similar command is
I love this. First time seeing it.
Only in enforced.
Just set setenforce 0 for this
for this see policy log and create selinux policy with generator if developer was lazy
Highter productivicy before someone still all your code (like binance)
So the correct way to use SELinux is to checks notes disable it
I wish I could set up SELinux but NixOS doesn’t support it… I already do something similar where all files on root are wiped by default (E: on each boot) and I have to opt things into persistence so it’s definitely something that I’d like.