• 1 Post
  • 244 Comments
Joined 2 years ago
cake
Cake day: May 31st, 2024

help-circle






  • unless I put SELinux in permissive mode, which the Internet says is a bad thing.

    I am also The Internet, and I say unless it is an internet-exposed service, just do it. More security is never bad of course, but process isolation and privilege escalation prevention is pretty low on the list of security measures you should focus on. First thing, unless it’s meant to be a “public” service (one that someone without pre-authorization may access), it shouldn’t be exposed to the internet at all, and that alone brings the threat model from “definitely will be scanned and automatically attacked, decent chance it gets pwnd if you don’t have good passwords and update often” to “someone needs to be both skilled and targeting you”. Spend an afternoon or two setting up a VPN so you can access your services from wherever, and share them with select people.

    SELinux is the cause of many headaches, and its main proposition is against untrusted code or in a shared system. If it’s your box, in your network, and you’re not aiming for a Red Hat certification, it’s ok to disable it.








  • I’m going to be honest, as a long time Linux user I also think this is one of those issues that is more common than it should be. It’s incredibly annoying and really pushes you away from using it as your daily driver.

    Btw, check your last boot’s log with sudo journalctl -e -b -1 to see what its dying words were. If you’re lucky it’s dying when coming back up and spitting the related errors in red, but sometimes it will just be “Reached target sleep” in which case it’s a bit of a bitch to troubleshoot. You can look through the logs to see if any error might be related, but if you’re not well versed in Linux it might as well be an alien language. Common suspects: Nvidia, Bluetooth, encrypted swap or RAM, ACPI bugs, BIOS needs an update.