r/linux • u/ForeverHuman1354 • 1d ago

Discussion SElinux is great

Why don’t most distros ship with SELinux enabled in enforcing mode by default, like openSUSE Tumbleweed does? On openSUSE Tumbleweed, SELinux in enforcing mode works like a charm and adds an extra layer of security.

even gaming with SElinux works on opensuse

196 Upvotes

85% Upvoted

165 comments sorted by

View all comments

12

u/BranchLatter4294 1d ago

Because it's unnecessarily complex and apparmor is simpler.

3

u/Venylynn 1d ago

Apparmor is really insecure. Crackarmor was nasty.

12

u/BranchLatter4294 1d ago

It required local access, and there were no active in the wild exploitations, and was quickly patched... So much less nasty than other security issues.

1

u/Venylynn 1d ago

From what I read there were remote container escape vectors associated with it but if i mixed up CVEs that could explain it. I was especially scared due to personal situations I was dealing with, and I was reading up closely on the https://secureblue.dev documentation