There has been a steady uptick of people stating that they will migrate (or already have) to Debian – seeking refuge from what they see as greedy corporate influence. I understand the sentiment fully. However, there’s a problem here that I want to talk about: security.
The ugly truth is that security is hard. It’s tedious. Unpleasant. And requires a lot of work to get right.
Debian does not do enough here to protect users.
Long ago, Red Hat embraced the usage of SELinux. And they took it beyond just enabling the feature in their kernel. They put in the arduous work of crafting default SELinux policies for their distribution.
…
However, its default security framework leaves much to be desired. Debian’s decision to enable AppArmor by default starting with version 10 signifies a positive step towards improved security, yet it falls short due to the half-baked implementation across the system.
…
The fundamental difference between AppArmor and SELinux lies in their approach to Mandatory Access Control (MAC). AppArmor operates on a path-based model, while SELinux employs a significantly more complex type enforcement system. This distinction becomes particularly evident in container environments.
…
The practical implications of these differences are significant. In a SELinux environment, a compromised container faces substantial hurdles in accessing or affecting the host system or other containers, thanks to the dual barriers of type enforcement and MCS labels.
TLDR: According to the author, Debian’s use of AppArmour is not as effective as RedHat’s use of SELinux when it comes to security.
And it’s not. SELinux is much more secure, however much more complex. Although AppArmor also do the job, despite being easier to workaround it. But I don’t think this is a good argument against Debian.
The main argument is, the number of Debian’s Apparmor policies is not comparable to RHEL’s SELinux policies.
This sounds more like it comes from this persons beliefs and bias than hard evidence. Debian can be slow to patch vulnerabilities but they aren’t oblivious to security.
What does an ordinary RHEL admin do when something does not work?
answer
setenforce 0sudo systemctl disable firewalld
Ok, aside from Android, I’ve yet to see any serious usage of SELinux in the real world and I’ve been working on cloud tech for years. Acknowledged issues such as complexity aside, it’s really just that much less relevant in a modern, single purpose environment such as Docker/kubernetes/cloud functions/etc
I’ve yet to see any serious usage of SELinux in the real world
I too have successfully avoided it, but we must acknowledge that not everyone has been so fortunate.
You need SElinux to lock down a system
The threat model seems a bit like fearmongering. Sure, if your container gets breached and attacker can (on some occasions) break out of it, it’s a big deal. But how likely that really is? And even if that would happen isn’t the data in the containers far more valuable than the base infrastructure under it on almost all cases?
I’m not arguing against SELinux/AppArmor comparison, SElinux can be more secure, assuming it’s configured properly, but there’s quite a few steps on hardening the system before that. And as others have mentioned, neither of those are really widely adopted and I’d argue that when you design your setup properly from the ground up you really don’t need neither, at least unless the breach happens from some obscure 0-day or other bug.
For the majority of data leaks and other breaches that’s almost never the reason. If your CRM or ecommerce software has a bug (or misconfiguration or a ton of other options) which allows dumping everyones data out of the database, SElinux wouldn’t save you.
Security is hard indeed, but that’s a bit odd corner to look at it from, and it doesn’t have anything to do with Debian or RHEL.
Debian can be a little slow patching things. However, like you said that’s probably not an issue. The biggest risk are large software packages like the Linux kernel and Chromium.
You do know that you can run SELinux on Debian right?
And MAC isn’t the end-all for security arguments
Are the default policies good though? There’s some collaboration between Fedora and Tumbleweed for SELinux policies, I imagine even more now since Tumbleweed plans to move to SELinux in the near future and derivatives like Aeon are already using SELinux.
It depends on how you set it up and what software you are running.
Use the defaults as a starting point and then move on from there
You can lock it down really hard if you want to. Debian’s relatively simple design makes it so there are a lot less moving parts in my experience.
The author is talking about the server use-case here but it’s not any better for desktops either. I think it boils down to the fact that neither of these operating systems are designed for a single-user world like Android (or any other modern mobile OS) and so these security solutions are shoehorned into a world where they don’t really fit into. Because those (server or desktop) programmes have different set of expectations about what’s available to them, than say, an Android app that knows that it has to ask for permission first.
I use Debian in Qubes. Checkmate.
@pnutzh4x0r if only the author of that rant knew that they could install SELinux on Debian, and that Debian does not, in fact, have apparmor enabled “by default”.
Everything has security issues. That’s a good thing as it means there are people finding things. I do wish Debian was a little faster on patching things but I also understand that they have a limited number of people. There are thousands on packages and a large amount of new security vulnerabilities. Patching takes man power and they only have so much to go around.
Debian isn’t this security mess like this person makes it sound. They can be slow on patches but the reality is a lot of these vulnerabilities aren’t getting readily exploited in the wild. Just keep up with the security tracker and follow basic security practices such as least privilege and security in depth.
