Products · Product
SELinux
Raised as a usability problem by 104 people on Hacker News over 16 years (2011–2026), in 64 threads.
No issue was raised by at least 3 people in 3 threads this year.
Every issue, all time, most people first
Complexity leads people to disable it; docs suggest turning it offUnreviewed
20112026- So annoying to work with that people disable it whenever it gets in the way2026-08-05
- Tool exposes all complexity without hiding it, so users find it painful and advise disabling it2022-04-27
- Hard to adopt and use; poorly explained and documented, so people turn it off2022-04-27
audit2allow is hard to reason about and may allow unintended thingsUnreviewed
20112026- Documentation hard to use; can't find how to write reusable policy, only audit2allow tutorials2024-09-04
- Compiled policies, complicated tooling and audit logs are hard for administrators to work with2022-09-01
- Hard to learn, so admins turn it off or blindly apply audit2allow2022-04-27
Unreviewed issues were grouped by machine: Claude Haiku labelled each comment as a usability complaint, named what it's about and summed up the problem in a line, and a small model grouped similar problems. Nobody has checked them by hand. Expect mistakes.
The newest 50 complaints
- Actually configuring SELinux is a massive pain, with the problem in the UI/UX layer2026-10-03
- Configuring SELinux is a massive pain for users2026-10-03
- So annoying to work with that people disable it whenever it gets in the way2026-08-05
- Must dig through syslog to enable and permit needed actions2026-07-26
- Poor UX led everyone to disable SELinux at install time2026-06-21
- Hard to set up and awkward to use day to day2026-05-19
- Users disable SELinux because its tooling is horrible when it blocks normal use2026-05-08
- Denials are cryptic; users run tools and hope a magic string works2025-12-13
- Many desktop users disable SELinux because it is difficult to use2025-09-12
- SELinux blocks bind-mounted config files with confusing permission denied errors, and the fixes are hard to figure out2025-09-06
- Hard to specify upfront what files to allow and later change the list2025-03-23
- Generating the allowlist is error prone, so people must frequently allow good behaviors2025-01-14
- Hostile to developers and users, hard to work with2025-01-07
- Breaks after a disk swap and rsync; sparse documentation makes recovery hard2024-10-25
- Security policy language and tooling are so complex that people can't use them2024-09-05
- Gives so many knobs and controls that it is hard to work with2024-09-04
- Documentation hard to use; can't find how to write reusable policy, only audit2allow tutorials2024-09-04
- Managing SELinux policies in any coherent way is a nightmare; tools fail to surface its features2024-09-04
- Blocks things silently without telling the user, making it hard to understand2024-09-04
- Considered user hostile, with no specific problem described2024-03-11
- Hard to understand: poor documentation, confusing mental model, bad CLI and unhelpful error messages2024-01-13
- Very complicated and difficult to configure, causing container permission failures2023-12-14
- Configuring new SELinux rules is hard to do2023-07-06
- Users find SELinux so hard to understand that they disable it instead2023-01-24
- MAC policies are so awkward and brittle that most users disable them2023-01-01
- Compiled policies, complicated tooling and audit logs are hard for administrators to work with2022-09-01
- SELinux is complicated and annoying to use compared to AppArmor2022-07-17
- Hard to use, so people avoid it for process filesystem isolation2022-06-28
- Cryptic error messages and poor documentation make it hard to figure out what is blocking a service2022-04-27
- Policies are opaque; relabeling files for Apache breaks things with no clear reason2022-04-27
- Crafting correct SELinux rules is so hard that even experts struggle2022-04-27
- Creating policies is error-prone and annoying, so admins run permissive mode instead2022-04-27
- Hard to learn, so admins turn it off or blindly apply audit2allow2022-04-27
- Audit log entries are unclear, and generating policy modules takes too many complicated steps2022-04-27
- Opaque policy layer gives poor error messages and forces checking a second configuration location2022-04-27
- Hard to adopt and use; poorly explained and documented, so people turn it off2022-04-27
- Failures are silent and confusing, so users take ages to find SELinux as the cause2022-04-27
- No canonical entry point; raw logs too cluttered to diagnose why processes fail2022-04-27
- Tool exposes all complexity without hiding it, so users find it painful and advise disabling it2022-04-27
- Hard to find what policies, labels and their interactions are2022-04-27
- SELinux cookbook-style documentation is very hard to find online2022-04-27
- Developers find SELinux incomprehensible, a blackhole they can't make sense of2022-04-27
- Developers can't tell which files and syscalls their app needs, so policies are hard to write2022-04-27
- Largely unusable in practice, especially for custom applications2022-04-27
- SELinux is so hard to administer it's almost useless in practice2022-04-11
- Configuration is so complex that users make thousands of mistakes2022-03-25
- Functionally unusable for the commenter, due to its historical ties2022-03-15
- Hard to tell when SELinux is blocking things and to unblock them specifically2022-03-04
- Audit2allow is very hard to reason about; may allow unintended things2022-03-04
- Users can't understand or fix SELinux blocking their programs; it's inscrutable to lay people2022-03-04