SELinux provides a strong security measure that can make an SELinux-enabled operating system a type of “fortress”: the so-called “confined users” [1] [2] [3], which add security and isolation capabilities that are in several respects comparable to containers but without many of their restrictions in GUI use cases (this topic is focused on desktop use cases, not server, infra, and such). By default, SELinux does not enforce much within user accounts but only around them. But in graphical desktop...
I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.
I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.
Nitpick: it’s not that AppArmor isn’t as secure, it’s just that SELinux is more powerful. The security always is up to the profiles.
If you were to compare the policies for Fedora and e.g. Debian, I would assume Fedora has better ones though lol
For sure. I believe Debian’s AppArmor integration is a little bit of an afterthought and there’s lots of patches missing as Canonical likes to keep many improvements downstream.
Is Fedora the only mainstream desktop distribution to ship with SELinux?
afaik yes, at least the arch kernel has selinux enabled, but you need to install the user space tools from the AUR.
But the profiles are pretty poor and basic AFAIK.
I’m not aware of another one. Some other distros like Ubuntu and OpenSUSE ship AppArmor instead, which does similar things but isn’t considered quite as secure.
I know plenty of other popular distros don’t ship any Mandatory Access Control system at all which seems like a very bad security practice to me. Same thing with Firewalls.
Nitpick: it’s not that AppArmor isn’t as secure, it’s just that SELinux is more powerful. The security always is up to the profiles.
If you were to compare the policies for Fedora and e.g. Debian, I would assume Fedora has better ones though lol
For sure. I believe Debian’s AppArmor integration is a little bit of an afterthought and there’s lots of patches missing as Canonical likes to keep many improvements downstream.
Removed by mod
I suggest you check Silverblue + Ansible (or CoreOS/IoT for server stuff).
Removed by mod
Maybe Opensuse?
From what I’ve found it’s not implemented by default.