SELinux

“it's secure enough to use Firefox with ublock + privacy badger and enforcing SELinux”

“if you are willing to fiddle with SELinux you can get whatever you need”

“actually configuring SELinux rather than working around it is a massive pain”

“SELinux is a rather poor design, and I find that it actively gets in the way of trying to do security well.”

“SElinux plus cgroups is probably good enough. Although as soon as it talks to the desktop environment all bets are off.”

“apparmor/selinux pair incredibly well”

“It's got the SELinux problem of being useful, but annoying enough that everyone just disables it the second it gets in the way.”

“The facilities are there, but it feels like writing your own OS.”

“Selinux is especially powerful for this kind of thing but also requires a lot of advanced knowledge and skills to setup and maintain sadly.”

“use an LSM like Tomoyo, App Armor or SELinux to not allow the AI to read the secrets file”

“the notoriously difficult to use SELinux uses this as the more-or-less standard way of setting permissions”

“SELinux would've stopped this.”

“it appears these distros were (and are) still vulnerable to this exploit”

“it's become much easier to reason about. It's not actually all that complex.”

“Last time I tried it was a pain to setup and a pain to use”

“In this day and age infrastructure operators should familiarize themselves with proactive defenses”

“robust software with poor UX/DX gets undermined by that poor UX/DX”

“it is difficult enough that the usual answer is "disable SELinux" or "don't apply it"”

“There is always selinux if we want to add protection against arbitrary code running as root.”

“combined with sensible SELinux policies, would likely be sufficient”

“SELinux by default is a huge plus all by itself.”

“strictly limiting features like user namespaces through SELinux would make Linux significantly more secure”

“Selinux does the rest and we encourage devs to write policies for their applications.”

“SELinux would be a lot more viable if it had a solid way to federate and distribute policy”

“MAC is already there on most modern distros, but people are often scared to go through training”

“our security relies on SELinux”

“Gave up configuring SELinux years ago because it was too time-consuming.”

“it's well tested, no amount of forks and tricky indirections to bypass syscalls”

“SElinux is also quite robust in access permission handling.”

“If you need more sophisticated controls try extensions like acl or selinux.”

“SELinux will protect you from many so-called "zero-day" vulnerabilities.”

“it's a very valuable tool when you run systems that are exposed to the internet or other hostile environments”

“Believing SELinux solves the vast majority of security issues is fallacious”

“SELinux errors are still an inscrutable mess and writing SELinux policy is fairly painful.”

“there is a ready made solution to this, one that dbus is already aware of and can use natively”

“It's a cryptic nightmare. You run a tool that gives you some magic string and hope that it works”

“it is designed for traditional servers that don't change often”

“when people have issues getting software to work, the first thing they are told to try is to turn all that stuff off”

“Secure Boot + LUKS + SELinux gives anyone a pretty airtight userspace.”

“you may be able to limit the damage from these attacks by using a MAC”