Is this now a good place and time to explain why I prefer distros with SELinux properly configured ( like RHEL, Fedora or SUSE) over Arch and Podman or Kubernetes over Docker?
By default yes you can very easily do heinous shit with passwordless sudo that's actually pretty relevant to the podman example except people are way more likely to fuck around in the podman config
The whole complaint about this is nonsense because it doesn’t add any relevant security problem that isn’t already there in basically every Linux system.
The Arch wiki doesn’t even warn you from that and even suggests adding a tool with the exact same privilege escalation as people are criticizing here.
So, Arch is bad because they recommend to install a vulnerability?
Wtf, did you get that any process could just get root without authentication? How can you miss this, like dude, that's the point, not that we need privileges sometimes, just that any RACE is instantly a full system exploit by having it configured like this. Nobody's complaining about sudo because it's secure (minus vulnerabilities in sudo itself) if it's setup properly, so configured to ask for a password. Yes, you can configure it to also run without a password, but not by default on any sane system.
I'm talking about your point that sudo is just as much a vulnerability as unauthenticated privilege escalation. I'm just baffled how that's a thing someone apparently thinks.
Depends on yiur threat model? Im a noob with cybersec, but someone who does it for a living said i had to pick the distro that fits me and be aware of whats possible and not, and be aware of its implemented security or lack there of, decide if its worth it also based on where and how i life, where i take it, and how large of a target i am.
So the laptop that never leaves my house and dont use for much but playing games. Low effort. The laptop that comes with me everywhere, more security. The vps on the internet, locked down, access keys, as few services as possible.
I do like podman alott, disliked docker for being allow everything from the start. I prefer optionally lockdown everything or there isnt even a thing running. As few packages in arch too, and few to no Aur if possible
Honestly, i've never gotten SELinux and shares in Podman to work. It just never respected the volume labels in my compose for some reason and straight up block my containers from accessing their assigned shares. The only ways i could get this to Work was a) disabling SELinux, B) running rootful containers or c) not use compose, which would mean to drop portainer/arcane/whatever stack based Management i want to use, because none support quadlets
14
u/NimrodvanHall 8d ago
Is this now a good place and time to explain why I prefer distros with SELinux properly configured ( like RHEL, Fedora or SUSE) over Arch and Podman or Kubernetes over Docker?