[candiddevmike]

Sorry, I was responding to the parent's question about why one was disabled over the other. Yes, SELinux is more capable, at the cost of additional complexity. I think it's debatable how many companies need that complexity, especially outside of the federal space.

[vundercind]

I’d bet money the main practical purpose SELinux serves is to check boxes when negotiating government contracts, in a way that’s familiar and can be called a standard.

Then in practice someone ends up writing a couple policy statements and filing a couple forms then disabling it anyway, nearly every time.

If that’s the case it doesn’t need to actually work in practice, just hypothetically.

[ruthmarx]

I've never seen SELinux as a requirement for any auditing, and I've done a fair amount of auditing.

It's not the only project like it, it's the one that is most well known because it has the NSA attached and because it got incorporated into the main kernel.

It works in practice, absolutely, but most people are too intimidated or lazy to put in the effort to learn it.

[craig_s_bell]

For some distributions, CIS benchmarks (also used by various other security tools) now include guidelines for SELinux.

I couldn't find it in the Debian spec (probably because it uses AppArmor), but the RHEL benchmark has these.

Currently, server level 1 only requires permissive mode:

https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_...

  CIS Red Hat Enterprise Linux 9 v2.0.0 L1 Server — 1.3.1.4 Ensure the SELinux mode is not disabled

... While server level 2 specifies enforcing mode:

https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_...

  CIS Red Hat Enterprise Linux 9 v2.0.0 L2 Server — 1.3.1.5 Ensure the SELinux mode is enforcing