Fedora (again) forces me to disable SELinux

[Mark]

Hey,

I just installed the Fedora 9 Beta release and am doing a full system
update as we speak.
While downloading the updates nothing is wrong.. it just downloads and
that's it. But when installing the updates i get a ton of selinux
notices!! and this is just a default Fedora 9 beta followed by a yum
-y update.

Also another issue that i noticed was when looking at a flash
animation in firefox.. when i want to play the animation selinux
(again) drops in and tells me i can't. (or i need to run a command to
get it working).

Now i've tried to run selinux on Fedora 7 and 8 for as long as
possible just to see how long i can get around it.. i did some
commands in that time as well but i always end up with disabling
selinux.

I have no idea how other users are using fedora in a normal every day
usage without disabling selinux.. i agree that a firewall should be in
linux but selinux just doesn't seem mature yet (if it will ever be).
Perhaps it's time to start considering to turn off selinux and remove
it out of the fedora kernel completely? As long as it's blaming here
when i install updates or simply browse the web than selinux gets shut
down completely!

So.. how are you doing this?


Btw.. justging from the selinux stats here:
http://smolts.org/static/stats/stats.html it says that nearly 50%
(48.4%) is turning off selinux. And my guess is that all fedora
servers keep it on making up the other 50%.

[Naheem Zaffar]

Not many servers seem to be sending smolt stats. (57% desktop, 20%
laptop, 21% "unknown", 1% server according to those pages add all
unknown to servers, and it is still only around 22% of reported
setups.)

> From those 50% that have it turned off, I would guess a lot have it
off because of either past needs, or for following a "guide" advising
this.

I have used SElinux as the default setting since it started. Apart
from a few cases (iirc, there were at some point conflicts with ntfs
mounts...) it has been almost plain sailing for me. (I am however,
mostly a windows user...)

[Ahmed Kamal]

IMHO, it is much easier to keep selinux on for servers web or email ... etc,
that it is for desktop style machine, where you expect to do anything and
everything. But interactive users run in unrestricted specifically for that
I guess!

On Tue, Apr 1, 2008 at 1:37 AM, Naheem Zaffar <naheemzaffar(a)gmail.com&gt;
wrote:

>  Not many servers seem to be sending smolt stats. (57% desktop, 20%
>  laptop, 21% "unknown", 1% server according to those pages add all
>  unknown to servers, and it is still only around 22% of reported
>  setups.)
>
>  >From those 50% that have it turned off, I would guess a lot have it
>  off because of either past needs, or for following a "guide" advising
>  this.
>
>  I have used SElinux as the default setting since it started. Apart
>  from a few cases (iirc, there were at some point conflicts with ntfs
>  mounts...) it has been almost plain sailing for me. (I am however,
>  mostly a windows user...)
>
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Jef Spaleta]

On Mon, Mar 31, 2008 at 3:20 PM, Mark <markg85(a)gmail.com&gt; wrote:

>  Hey,
>
>  I just installed the Fedora 9 Beta release and am doing a full system
>  update as we speak.
>  While downloading the updates nothing is wrong.. it just downloads and
>  that's it. But when installing the updates i get a ton of selinux
>  notices!! and this is just a default Fedora 9 beta followed by a yum
>  -y update. 

Are you suggesting there are...bugs in the beta? That's an outrageous
accusation to make!
Oh wait.. not it isn't.  I'm sure there a set of bugs tracking selinux
issues that you should probably check.  There's also the test mailinglist
where you could post avc messages and try to get other people to help you
figure out why you are seeing them and if the underlying issue is a bug that
has been fixed in a subsequent rawhide update.


>  Also another issue that i noticed was when looking at a flash
>  animation in firefox.. when i want to play the animation selinux
>  (again) drops in and tells me i can't. (or i need to run a command to
>  get it working). 

Is this adobe's proprietary flash perchance?

-jef

["Jóhann B. Guðmundsson"]

We have to make sure the Gold does not contain any selinux 
errors/notification
and sub sequel updates there after so the end user can be sure that when
he receives an selinux incident report that report is of *devious* behavior
not selinux (policies ) not keeping up with updates..

Best regard
                 Johann B.

[Mark]

2008/4/1, Jeff Spaleta <jspaleta(a)gmail.com&gt;:
>  On Mon, Mar 31, 2008 at 3:20 PM, Mark <markg85(a)gmail.com&gt; wrote:
>  > Hey,
>  >
>  > I just installed the Fedora 9 Beta release and am doing a full system
>  > update as we speak.
>  > While downloading the updates nothing is wrong.. it just downloads and
>  > that's it. But when installing the updates i get a ton of selinux
>  > notices!! and this is just a default Fedora 9 beta followed by a yum
>  > -y update.
>
>  Are you suggesting there are...bugs in the beta? That's an outrageous
>  accusation to make!
>   Oh wait.. not it isn't.  I'm sure there a set of bugs tracking selinux
>  issues that you should probably check.  There's also the test mailinglist
>  where you could post avc messages and try to get other people to help you
>  figure out why you are seeing them and if the underlying issue is a bug that
>  has been fixed in a subsequent rawhide update. 
Well i'm not saying that Fedora beta has selinux bugs. just that till
now my experience with selinux has been bad and i have to turn it off
to have a normally functional desktop.
And i've seen selinux for at least a few years now in distributions
and there is always something wrong (perhaps not a bug but it annoys
the user) so i doubt that it will ever get "normal" (at a point where
i can just use the desktop without selinux asking my attention).

>  >
>  > Also another issue that i noticed was when looking at a flash
>  > animation in firefox.. when i want to play the animation selinux
>  > (again) drops in and tells me i can't. (or i need to run a command to
>  > get it working).
>
>  Is this adobe's proprietary flash perchance?
>  
Nope it isn't Fedora 9 (beta) gets some flash capable player in
firefox 3.. i didn't install adobe flash yet. The site i was looking
was: www.digg.com and than pressing the huge PLAY sign.

>  -jef 

2008/4/1, Andrew Farris <lordmorgul(a)gmail.com&gt;:
>  Mark wrote:
>   > Hey,
>   >
>   > I just installed the Fedora 9 Beta release and am doing a full system
>   > update as we speak.
>   > While downloading the updates nothing is wrong.. it just downloads and
>   > that's it. But when installing the updates i get a ton of selinux
>   > notices!! and this is just a default Fedora 9 beta followed by a yum
>   > -y update.
>
>
>  A few suggestions... first, this is beta software, so naturally the fresh beta
>   install is going to have some issues.  Why wouldn't you expect that it is
>   possible selinux wouldn't play quietly in its corner right after you install...
>   yet you probably wouldn't think twice about a few little issues with gdm or
>   nautilus? 
I wouldn't find it strange to see bugs in nautilus/gdm/any other than
selinux strange. Selinux is just: Annoying, frustrating, irritating
and asking to be disabled. My selinux history tells me that this isn't
a bug.. it's just selinux.

>   Now suggestions.
>   - To keep selinux running nicely on your desktop you need to relabel or
>   restorecon your files frequently, especially after any updates are done.  If you
>   update selinux-policy or your kernel, immediately do 'touch /.autorelabel' and
>   then reboot... when you don't you're tempting selinux to annoy you with denials
>   (expected behavior).
>   - Use tmpfs for /tmp.  This one suggestion from Dan Walsh has been very helpful
>   for my systems.  Just add the following line to your /etc/fstab:
>   tmpfs  /tmp  tmpfs  defaults 0 0
>
>    then do:
>   rm -Rf /tmp/*; reboot
>
>   Then remember that files in tmp are supposed to be temporary and don't save
>   large downloads, misc files, etc, in tmp... they will disappear at reboot, and
>   tmp is only 512Mb with tmpfs defaults.
>  
First: it requires a reboot which should not be the case for ANY linux
based program unless it has a good reason. Windows == reboots afer
every update. Don't follow that path on linux!

Second: it requires me to INVESTIGATE the issues, find solutions and
fix it. Sorry to tell but that's not my job nor am i willing to do it
and it requires a lot of time to fix issues that should not even
exist.

Third: The tmpfs thing might be handy but i would just like to run the
OS in it's default stuff. If i need to edit things like that then
there is something wrong with Fedora.

>   - Run selinux-policy-targeted (the default, so don't change it)
> and then learn a
>   little bit about what denials mean, why they happen, and report those that you
>   cannot figure out.  Use setroubleshoot and sealert.  I've got lots of denials in
>   my audit database right now (actually 30+ of them are new today, for various
>   stuff I've been testing)... but not one of them has stopped me from 'doing real
>   work' on the system.
>  
Again require me to do some work to get things fixed which should not
even be broken in the first place.

I simply don't get why such a idiotic system has to be in fedora...
Fedora is about user friendly distributions right? this one isn't user
friendly at all. Till now i've always disabled selinux as soon as the
first boot was completed.

Also a note about the selinux stats in the smolt database. When you
install fedora selinux is (sadly) enabled by default. And on the first
boot you get the smolt system specs sending stuff.. at that point
(atleast in F9 beta) there was NO option to turn off selinux so the
stats will therefore always indicate a higher selinux usage than is
actually the case. i turned it off right after those smolt things
where send but i'm in the smolt db now with selinux enabled!

O well.. enough selinux bashing for now ^_^

[Andrew Farris]

Mark wrote:
>  2008/4/1, Andrew Farris <lordmorgul(a)gmail.com&gt;:
> > Mark wrote:
> >  > Hey,
> >  >
> >  > I just installed the Fedora 9 Beta release and am doing a full system
> >  > update as we speak.
> >  > While downloading the updates nothing is wrong.. it just downloads and
> >  > that's it. But when installing the updates i get a ton of selinux
> >  > notices!! and this is just a default Fedora 9 beta followed by a yum
> >  > -y update.
> >
> >
> > A few suggestions... first, this is beta software, so naturally the fresh beta
> >  install is going to have some issues.  Why wouldn't you expect that it is
> >  possible selinux wouldn't play quietly in its corner right after you install...
> >  yet you probably wouldn't think twice about a few little issues with gdm or
> >  nautilus?
>  
>  I wouldn't find it strange to see bugs in nautilus/gdm/any other than
>  selinux strange. Selinux is just: Annoying, frustrating, irritating
>  and asking to be disabled. My selinux history tells me that this isn't
>  a bug.. it's just selinux. 
An assumption that is dangerous.  I understand prior bad selinux issues can 
leave you feeling that way, but consider how similar it is to just 'click ok for 
everything' in Windows?  Yes.. prior experience would tell you its something you 
have to do for it to work, but its also exploited by malicious code.  Assuming 
every selinux audit is a bug or just selinux being annoying is a terrible mindset.

> >  Now suggestions.
> >  - To keep selinux running nicely on your desktop you need to relabel or
> >  restorecon your files frequently, especially after any updates are done.  If you
> >  update selinux-policy or your kernel, immediately do 'touch /.autorelabel'
> and
> >  then reboot... when you don't you're tempting selinux to annoy you with
> denials
> >  (expected behavior).
> >  - Use tmpfs for /tmp.  This one suggestion from Dan Walsh has been very helpful
> >  for my systems.  Just add the following line to your /etc/fstab:
> >  tmpfs  /tmp  tmpfs  defaults 0 0
> >
> >   then do:
> >  rm -Rf /tmp/*; reboot
> >
> >  Then remember that files in tmp are supposed to be temporary and don't save
> >  large downloads, misc files, etc, in tmp... they will disappear at reboot, and
> >  tmp is only 512Mb with tmpfs defaults.
> >
>  
>  First: it requires a reboot which should not be the case for ANY linux
>  based program unless it has a good reason. Windows == reboots afer
>  every update. Don't follow that path on linux! 
Actually, any kernel update requires a reboot unless you're pulling monkey 
tricks (yes, it can 'kinda' be done without rebooting, but not with Fedora 
kernel updates).  Any time you update selinux policy you can get away without 
rebooting, just restoring contexts instead, but its much simpler... and less 
error prone, to do it while nothing is being used (i.e. before you really get 
the system booted).  Its not necessary, its 'best practice' for effectively 
testing and using selinux in its development state.  So don't reboot if you 
don't feel like it; I will.

>  Second: it requires me to INVESTIGATE the issues, find solutions and
>  fix it. Sorry to tell but that's not my job nor am i willing to do it
>  and it requires a lot of time to fix issues that should not even
>  exist. 
So, you'd rather just have a less secure system you can ignore?  Ok.

>  Third: The tmpfs thing might be handy but i would just like to run
> the
>  OS in it's default stuff. If i need to edit things like that then
>  there is something wrong with Fedora. 
I agree; Fedora should ship with tmpfs configured, but its not my call.  I'm 
just trying to help you.

> >  - Run selinux-policy-targeted (the default, so don't change
> it) and then learn a
> >  little bit about what denials mean, why they happen, and report those that you
> >  cannot figure out.  Use setroubleshoot and sealert.  I've got lots of denials
> in
> >  my audit database right now (actually 30+ of them are new today, for various
> >  stuff I've been testing)... but not one of them has stopped me from 'doing
> real
> >  work' on the system.
> >
>  Again require me to do some work to get things fixed which should not
>  even be broken in the first place. 
Beta.

>  I simply don't get why such a idiotic system has to be in
> fedora...
>  Fedora is about user friendly distributions right? this one isn't user
>  friendly at all. Till now i've always disabled selinux as soon as the
>  first boot was completed. 
Well, its clear you don't understand it, which is ok, but debating its purpose 
or implementation is not a reasonable use of time.  You may continue to disable 
SELinux... I'll continue to do everything I can to help the developers improve 
it because I value what it provides.

>  Also a note about the selinux stats in the smolt database. When you
>  install fedora selinux is (sadly) enabled by default. And on the first
>  boot you get the smolt system specs sending stuff.. at that point
>  (atleast in F9 beta) there was NO option to turn off selinux so the
>  stats will therefore always indicate a higher selinux usage than is
>  actually the case. i turned it off right after those smolt things
>  where send but i'm in the smolt db now with selinux enabled! 
Every update smolt does will fix that, showing it turned off on the machine. 
Don't be overly dramatic, noone really cares whether the smolt stats are 
slightly padded or not: its nothing more than 'close to reasonably accurate', 
and it won't determine whether SELinux continues to be developed or whether 
Fedora backs it.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Mark]

2008/4/1, Andrew Farris <lordmorgul(a)gmail.com&gt;:
>  Mark wrote:
>   > 2008/4/1, Andrew Farris <lordmorgul(a)gmail.com&gt;:
>   >> Mark wrote:
>   >>  > Hey,
>   >>  >
>   >>  > I just installed the Fedora 9 Beta release and am doing a full system
>   >>  > update as we speak.
>   >>  > While downloading the updates nothing is wrong.. it just downloads and
>   >>  > that's it. But when installing the updates i get a ton of selinux
>   >>  > notices!! and this is just a default Fedora 9 beta followed by a yum
>   >>  > -y update.
>   >>
>   >>
>   >> A few suggestions... first, this is beta software, so naturally the fresh beta
>   >>  install is going to have some issues.  Why wouldn't you expect that it is
>   >>  possible selinux wouldn't play quietly in its corner right after you
> install...
>   >>  yet you probably wouldn't think twice about a few little issues with gdm
> or
>   >>  nautilus?
>   >
>   > I wouldn't find it strange to see bugs in nautilus/gdm/any other than
>   > selinux strange. Selinux is just: Annoying, frustrating, irritating
>   > and asking to be disabled. My selinux history tells me that this isn't
>   > a bug.. it's just selinux.
>
>
>  An assumption that is dangerous.  I understand prior bad selinux issues can
>   leave you feeling that way, but consider how similar it is to just 'click ok for
>   everything' in Windows?  Yes.. prior experience would tell you its something you
>   have to do for it to work, but its also exploited by malicious code.  Assuming
>   every selinux audit is a bug or just selinux being annoying is a terrible mindset.
>  
Selinux keeps proving me that it deserves to shut down. i can't help
it that it blames me for playing flash animation, using a gif
animation in a local web folder or oven just installing updates from
fedora itself..

>   >>  Now suggestions.
>   >>  - To keep selinux running nicely on your desktop you need to relabel or
>   >>  restorecon your files frequently, especially after any updates are done.  If
> you
>   >>  update selinux-policy or your kernel, immediately do 'touch
> /.autorelabel' and
>   >>  then reboot... when you don't you're tempting selinux to annoy you
> with denials
>   >>  (expected behavior).
>   >>  - Use tmpfs for /tmp.  This one suggestion from Dan Walsh has been very
> helpful
>   >>  for my systems.  Just add the following line to your /etc/fstab:
>   >>  tmpfs  /tmp  tmpfs  defaults 0 0
>   >>
>   >>   then do:
>   >>  rm -Rf /tmp/*; reboot
>   >>
>   >>  Then remember that files in tmp are supposed to be temporary and don't
> save
>   >>  large downloads, misc files, etc, in tmp... they will disappear at reboot,
> and
>   >>  tmp is only 512Mb with tmpfs defaults.
>   >>
>   >
>   > First: it requires a reboot which should not be the case for ANY linux
>   > based program unless it has a good reason. Windows == reboots afer
>   > every update. Don't follow that path on linux!
>
>
>  Actually, any kernel update requires a reboot unless you're pulling monkey
>   tricks (yes, it can 'kinda' be done without rebooting, but not with Fedora
>   kernel updates).  Any time you update selinux policy you can get away without
>   rebooting, just restoring contexts instead, but its much simpler... and less
>   error prone, to do it while nothing is being used (i.e. before you really get
>   the system booted).  Its not necessary, its 'best practice' for effectively
>   testing and using selinux in its development state.  So don't reboot if you
>   don't feel like it; I will.
>  
Oke that's a extreme example. If the kernel gets updated than it
deserves a reboot :) but for all other things (software related) than
no.. it should not require a reboot

>   > Second: it requires me to INVESTIGATE the issues, find solutions and
>   > fix it. Sorry to tell but that's not my job nor am i willing to do it
>   > and it requires a lot of time to fix issues that should not even
>   > exist.
>
>
>  So, you'd rather just have a less secure system you can ignore?  Ok. 
Well if it's with the annoying things that i've experienced with
selinux today and in the recent years than yes. Surely selinux can
spit out real warning that could potential be a real thread.. just
never seen one before and i've seen quite a few warnings.
>   > Third: The tmpfs thing might be handy but i would just like to run the
>   > OS in it's default stuff. If i need to edit things like that then
>   > there is something wrong with Fedora.
>
>
>  I agree; Fedora should ship with tmpfs configured, but its not my call.  I'm
>   just trying to help you.
>  
And thanx for the help ^_^
>   >>  - Run selinux-policy-targeted (the default, so don't change it) and then
> learn a
>   >>  little bit about what denials mean, why they happen, and report those that
> you
>   >>  cannot figure out.  Use setroubleshoot and sealert.  I've got lots of
> denials in
>   >>  my audit database right now (actually 30+ of them are new today, for various
>   >>  stuff I've been testing)... but not one of them has stopped me from
> 'doing real
>   >>  work' on the system.
>   >>
>   > Again require me to do some work to get things fixed which should not
>   > even be broken in the first place.
>
>
>  Beta. 
Not beta! This is selinux related and is like this for years so don't
tell me it's because of "beta". Otherwise try out Fedora 8 final fully
updated to see for yourself. It's (again) just selinux.
>   > I simply don't get why such a idiotic system has to be in fedora...
>   > Fedora is about user friendly distributions right? this one isn't user
>   > friendly at all. Till now i've always disabled selinux as soon as the
>   > first boot was completed.
>
>
>  Well, its clear you don't understand it, which is ok, but debating its purpose
>   or implementation is not a reasonable use of time.  You may continue to disable
>   SELinux... I'll continue to do everything I can to help the developers improve
>   it because I value what it provides. 
I'm interested in trying it out and having a secured linux machine but
not this way. Once it's illnesses are fixed (if that ever gets done)
and selinux only spits out warnings like every other firewall is doing
than i will probably use it by default as well. Just not now because
of the reasons i told a few times now.
>   > Also a note about the selinux stats in the smolt database. When you
>   > install fedora selinux is (sadly) enabled by default. And on the first
>   > boot you get the smolt system specs sending stuff.. at that point
>   > (atleast in F9 beta) there was NO option to turn off selinux so the
>   > stats will therefore always indicate a higher selinux usage than is
>   > actually the case. i turned it off right after those smolt things
>   > where send but i'm in the smolt db now with selinux enabled!
>
>
>  Every update smolt does will fix that, showing it turned off on the machine.
>   Don't be overly dramatic, noone really cares whether the smolt stats are
>   slightly padded or not: its nothing more than 'close to reasonably accurate',
>   and it won't determine whether SELinux continues to be developed or whether
>   Fedora backs it.
>  
Not a big issue. just something worth noting incase anyone was gonna
point me to the numbers who are "using" selinux.
>   --
>   Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
>    gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
>    revoked key 0xC99B1DF3 no longer used
>   No one now has, and no one will ever again get, the big picture. - Daniel Geer
>   ----                                                                       ----
>
>   --
>   fedora-devel-list mailing list
>   fedora-devel-list(a)redhat.com
>   https://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Rahul Sundaram]

Mark wrote:

>  
>  I'm interested in trying it out and having a secured linux machine but
>  not this way. Once it's illnesses are fixed (if that ever gets done)
>  and selinux only spits out warnings like every other firewall is doing
>  than i will probably use it by default as well. Just not now because
>  of the reasons i told a few times now. 
You keep repeating it but note that SELinux is not a firewall and 
doesn't behave like one because it isn't one.

http://fedoraproject.org/wiki/SELinux

Rahul

[Mark]

2008/4/1, Rahul Sundaram <sundaram(a)fedoraproject.org&gt;:
>  Mark wrote:
>
>   >
>   > I'm interested in trying it out and having a secured linux machine but
>   > not this way. Once it's illnesses are fixed (if that ever gets done)
>   > and selinux only spits out warnings like every other firewall is doing
>   > than i will probably use it by default as well. Just not now because
>   > of the reasons i told a few times now.
>
>
>  You keep repeating it but note that SELinux is not a firewall and
>   doesn't behave like one because it isn't one.
>
>   http://fedoraproject.org/wiki/SELinux
>
>   Rahul 
Reading this: http://www.nsa.gov/selinux/info/faq.cfm#I1 (point 1., 2.
and 3.) reminds me a great deal of Vista's UAC which i also turn off
as soon as i encounter it. If i get the idea (correct me if i'm wrong)
than selinux is isolating a application just like you as a user are
isolated in yout user account. and if a attacker attacks a piece of
software it can only effect that part of the software.. o well if
that's the case than it's more than a firewall indeed but it's still
irritating. Also if i )as a user) run a application and a attacker
strikes that application than the attacker still can't do more than i
as a user can do so it doesn't seem to add that much advantage. But i
might be wrong..??

[Andrew Farris]

Mark wrote:
>  Also if i )as a user) run a application and a attacker
>  strikes that application than the attacker still can't do more than i
>  as a user can do so it doesn't seem to add that much advantage. But i
>  might be wrong..?? 
Yes, you're slightly wrong there.  Compromised software can be far more 
destructive than you'd initially think.  If you can't delete a file, that 
doesn't mean broken and exploited software can't do it while you run it.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Matej Cepl]

On Tue, 01 Apr 2008 03:33:06 +0200, Mark scripst:
>  doesn't seem to add that much advantage. But i might be wrong..??
Yes, you are ;-). Even totally screwed up Apache server totally in hands 
of script-kiddie via totally screwed up PHP release (not that it would 
ever happen, just a theoretical example) cannot do more than it is 
allowed to do by SELinux -- and that's not that much.

Matej

-- 
The content of this message is licensed under a Creative Commons 
Attribution 3.0 License, Some Rights Reserved.
http://creativecommons.org/licenses/by/3.0/us/

[Gianluca Sforna]

On Thu, Apr 3, 2008 at 11:33 AM, Matej Cepl <mcepl(a)redhat.com&gt; wrote:
>  On Tue, 01 Apr 2008 03:33:06 +0200, Mark scripst:
>
>  > doesn't seem to add that much advantage. But i might be wrong..??
>
>   Yes, you are ;-). Even totally screwed up Apache server totally in hands
>   of script-kiddie via totally screwed up PHP release (not that it would
>   ever happen, just a theoretical example) cannot do more than it is
>   allowed to do by SELinux -- and that's not that much. 
I think I remember a recent case for SELinux lowering the impact of a
_real_ security issue in one package.
I wanted to blog about it but could not find it anymore :(

[Rahul Sundaram]

Gianluca Sforna wrote:
>  On Thu, Apr 3, 2008 at 11:33 AM, Matej Cepl <mcepl(a)redhat.com&gt;
> wrote:
> > On Tue, 01 Apr 2008 03:33:06 +0200, Mark scripst:
> >
> >> doesn't seem to add that much advantage. But i might be wrong..??
> >  Yes, you are ;-). Even totally screwed up Apache server totally in hands
> >  of script-kiddie via totally screwed up PHP release (not that it would
> >  ever happen, just a theoretical example) cannot do more than it is
> >  allowed to do by SELinux -- and that's not that much.
>  
>  I think I remember a recent case for SELinux lowering the impact of a
>  _real_ security issue in one package.
>  I wanted to blog about it but could not find it anymore :( 
There are several. Refer to the mitigation news section in

http://tresys.com/selinux/

Rahul

[Andrew Farris]

Mark wrote:
>  2008/4/1, Andrew Farris <lordmorgul(a)gmail.com&gt;:
> > Beta.
>  
>  Not beta! This is selinux related and is like this for years so don't
>  tell me it's because of "beta". Otherwise try out Fedora 8 final fully
>  updated to see for yourself. It's (again) just selinux. 
You have to understand how much about selinux is a moving target because Fedora 
is a moving target; this is very much an issue of 'beta'.  SELinux policy is not 
developed in a vacuum or indepedently.  Its not just another application helping 
to secure the system along with your firewall; it must handle the oddball 
behavior of every constrained bit of code on the system.  It can never be 'just 
selinux' because selinux is not that type of application/package (the fact that 
you can turn it off doesn't mean its 'separate').

There may never be a fully complete policy that can drop into a distribution and 
'just work'.  Fedora is a rapidly changing package space; the policy plays keep 
up, so yeah, its always a beta issue until the full release.  It basically 
starts over as the totally new versions of software show up -- the more the 
software changes, the more the policy is deficient to work with it.  The feature 
set of F9 has alot different from F8, with major code changes that effect the 
selinux policy... its not all auto generated (which btw is impossible because 
programs are  deterministic but programmers are not, selinux constrains both how 
and 'why' accesses occur).

Having hundreds of denials as you try to update is NOT normal selinux behavior; 
that happens only when something is really broken.  It also happens often when 
people try to run selinux here and there, trying to turn it on and get things 
going, having issues, and shutting it off again for weeks.  Trust me I realize 
how that goes.. I've made a conscious effort to keep my systems (both stable and 
testing systems) running selinux enforcing since it showed up in Fedora.  It 
takes alot of time but its dramatically improved and continues to improve!

I have run F8, and I ran it selinux enforcing for months.  It really does get 
easier to work with the more you try, and especially the less your system 
packages are changing.  But I'm also not saying that selinux is a finished 
product... sometimes it does cause problems, but I've seen legitimate audits as 
well (not that often, but when they become frequent we'll all be glad that 
selinux developers/testers did this work now and not starting then).

And that wall of text is just to say, you ran into a pretty bad little beta 
issue, it happens. :)

> >  > I simply don't get why such a idiotic system has to be
> in fedora...
> >  > Fedora is about user friendly distributions right? this one isn't user
> >  > friendly at all. Till now i've always disabled selinux as soon as the
> >  > first boot was completed.
> >
> >
> > Well, its clear you don't understand it, which is ok, but debating its purpose
> >  or implementation is not a reasonable use of time.  You may continue to disable
> >  SELinux... I'll continue to do everything I can to help the developers improve
> >  it because I value what it provides.
>  
>  I'm interested in trying it out and having a secured linux machine but
>  not this way. Once it's illnesses are fixed (if that ever gets done)
>  and selinux only spits out warnings like every other firewall is doing
>  than i will probably use it by default as well. Just not now because
>  of the reasons i told a few times now. 
I hope it gets there too, but again, the nature of the beast is that policy 
won't be perfect unless software stops changing, and we don't want that.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Jef Spaleta]

On Mon, Mar 31, 2008 at 5:13 PM, Mark <markg85(a)gmail.com&gt; wrote:

>  Selinux keeps proving me that it deserves to shut down. i can't
> help
>  it that it blames me for playing flash animation, using a gif
>  animation in a local web folder or oven just installing updates from
>  fedora itself..
>  
Actually you CAN help.. you CAN help by taking the hint i provided earlier
and start talking to people through the test list so we can troubleshoot the
specific messages you have been seeing..instead of doing what you are doing
right now, which is failing to communicate with enough specificity for
anyone to confirm or help track down so things can be fixed.  Clearly you've
made up you mind... you decided you don't WANT to help. That's fine.. that's
your choice... but do so with the understanding that by doing so you cheapen
the testing process that the pre-releases is meant to fulfill.  By choosing
to ignore selinux completely, you certainly aren't living up to the implied
agreement to act as a responsible tester when you chose to make use of the
pre-releases.

-jef"permissive mode is a available a compromise"spaleta

[darrell pfeifer]

2008/3/31 Jeff Spaleta <jspaleta(a)gmail.com&gt;:
>  On Mon, Mar 31, 2008 at 5:13 PM, Mark <markg85(a)gmail.com&gt; wrote:
>  > Selinux keeps proving me that it deserves to shut down. i can't help
>  > it that it blames me for playing flash animation, using a gif
>  > animation in a local web folder or oven just installing updates from
>  > fedora itself..
>  >
>  >
>  >
>  >
>
>  Actually you CAN help.. you CAN help by taking the hint i provided earlier
>  and start talking to people through the test list so we can troubleshoot the
>  specific messages you have been seeing..instead of doing what you are doing
>  right now, which is failing to communicate with enough specificity for
>  anyone to confirm or help track down so things can be fixed.  Clearly you've
>  made up you mind... you decided you don't WANT to help. That's fine.. that's
>  your choice... but do so with the understanding that by doing so you cheapen
>  the testing process that the pre-releases is meant to fulfill.  By choosing
>  to ignore selinux completely, you certainly aren't living up to the implied
>  agreement to act as a responsible tester when you chose to make use of the
>  pre-releases.
>    -jef"permissive mode is a available a compromise"spaleta
>  
Yes, security is a compromise. Having dealt with selinux for quite
some time I've typically tried it, re-tried it, re-tried it again,
weighed my options and turned it off.

I didn't realize that turning off selinux meant I was such a bad
tester. I just thought it meant there were some parts of the system
that I was unwilling to test. I don't feel cheap or irresponsible.

If testing selinux is such an important part of the testing agreement,
please publish this information in a written rather than tacit place.

darrell

darrell

[Matej Cepl]

On Mon, 31 Mar 2008 19:32:16 -0700, darrell pfeifer scripst:
>  I didn't realize that turning off selinux meant I was such a bad
> tester.
>  I just thought it meant there were some parts of the system that I was
>  unwilling to test. I don't feel cheap or irresponsible.
>  
>  If testing selinux is such an important part of the testing agreement,
>  please publish this information in a written rather than tacit place. 
No turning off selinux doesn't make you bad tester, certainly not. But 
the point I have is that it is really not that bad -- there ARE many bugs 
in SELinux policy (because it is built against moving target of still 
changing Fedora), but OTOH dwalsh is really unbelievable -- bugs I filed 
with him in CC list (he prefers to file bugs against the programs which 
have problems) and SELinux keyword are in 80% of cases (or even more) 
fixed to the next day. And I have filed many many many bugs for him :-)

Matej

-- 
The content of this message is licensed under a Creative Commons 
Attribution 3.0 License, Some Rights Reserved.
http://creativecommons.org/licenses/by/3.0/us/

[David Mansfield]

On Mon, 2008-03-31 at 17:58 -0800, Jeff Spaleta wrote:
>  
>  
>  On Mon, Mar 31, 2008 at 5:13 PM, Mark <markg85(a)gmail.com&gt; wrote:
>          Selinux keeps proving me that it deserves to shut down. i
>          can't help
>          it that it blames me for playing flash animation, using a gif
>          animation in a local web folder or oven just installing
>          updates from
>          fedora itself..
>          
>          
>  
>  Actually you CAN help.. you CAN help by taking the hint i provided earlier and start
> talking to people through the test list so we can troubleshoot the specific messages you
> have been seeing..instead of doing what you are doing right now, which is failing to
> communicate with enough specificity for anyone to confirm or help track down so 
Hey, to extend this 'you can help' thing, is it possible that a
smolt-like setroubleshoot logger could be installed which automatically
(after asking for permission of course) posts the denials to a database
so developers could see statistics, say, after a big batch of updates?  

I think one thing that's frustrating is to have to open a bugzilla for
each and every one.  It's way too much work.  There needs to be a
specific way to address these 'bogus' denails and get the updated
policies in a streamlined manner, IMHO.

David

[Jef Spaleta]

On Tue, Apr 1, 2008 at 5:35 AM, David Mansfield <fedora(a)dm.cobite.com&gt;
wrote:

>  Hey, to extend this 'you can help' thing, is it possible that
> a
>  smolt-like setroubleshoot logger could be installed which automatically
>  (after asking for permission of course) posts the denials to a database
>  so developers could see statistics, say, after a big batch of updates?
>  
This is a good idea but....this only helps if people keep selinux in at
least permissive.. instead of disabling it completely as part of testing.
Which means its probably not going to help solve whatever weirdness inspired
this particular thread.


>  I think one thing that's frustrating is to have to open a
> bugzilla for
>  each and every one.  It's way too much work.  There needs to be a
>  specific way to address these 'bogus' denails and get the updated
>  policies in a streamlined manner, IMHO. 

Uhm... you know.. we have a test-list where people can discuss things..
including selinux avc message... with other testers to try to help determine
if they are worth filing in bugzilla.
A database of avc messages that can be statically datamined isn't going to
magically 'solve' problems. It might show obvious problems, that are easily
reproduced...but if they are easily reproduced then the data is somewhat
unnecessary.

What really matters how to catch and correctly resolve issues that are more
sporadic in nature, that developers and the internal QA people can't
reproduce.   And that takes a commitment for the individual tester who is
experiencing the problem to communicate with other human beings as part of a
group effort to troubleshoot a subsystem.   If they don't care about the
subsystem..fine..then they can choose to disable it and then keep their
mouth shut about the problems with. But if they are going to be inspired or
frustrated by the problem enough to drag their opinion on to this list that
a particular subsystem should be disabled...without first making a sincere
effort to participate in the testing of the subsystem...well then..they
deserve my scorn for paying lip service to the community testing process.

As a tester, if you what you care about is crap like compiz ui problems, or
the fact that your trackpad is fubar'd.. or the fact that keyboard
localization doesn't work in gdm....and are putting in the effort to
communicate those problems with enough specificity for people to help
diagnose and fix it.. then you have earned some credibility to discuss your
feelings on the value of those subsystems.  But just because you have done
your fair share on testing one subsystem does not give you authority to
spout random opinions about the value of other subsystems which you haven't
been competently testing...selinux included.

When testers refuse to discuss the details of problems with at least other
testers, the community testing process fails.  This thread is a failure.
The original poster has failed to communicate the problems with enough
specificity for anyone to attempt to diagnose it.  Bugzilla be damned. We
have a mailinglist for testers, and the original poster clearly knows how to
use a mailinglist or else we wouldn't be wasting time on this thread.


-jef"I guess its time to resurrect my TestingManifesto page in the
wiki"spaleta

[Mark]

2008/4/1, Jeff Spaleta <jspaleta(a)gmail.com&gt;:
>  On Mon, Mar 31, 2008 at 5:13 PM, Mark <markg85(a)gmail.com&gt; wrote:
>  > Selinux keeps proving me that it deserves to shut down. i can't help
>  > it that it blames me for playing flash animation, using a gif
>  > animation in a local web folder or oven just installing updates from
>  > fedora itself..
>  >
>  >
>  >
>  >
>
>  Actually you CAN help.. you CAN help by taking the hint i provided earlier
>  and start talking to people through the test list so we can troubleshoot the
>  specific messages you have been seeing..instead of doing what you are doing
>  right now, which is failing to communicate with enough specificity for
>  anyone to confirm or help track down so things can be fixed.  Clearly you've
>  made up you mind... you decided you don't WANT to help. That's fine.. that's
>  your choice... but do so with the understanding that by doing so you cheapen
>  the testing process that the pre-releases is meant to fulfill.  By choosing
>  to ignore selinux completely, you certainly aren't living up to the implied
>  agreement to act as a responsible tester when you chose to make use of the
>  pre-releases.
>    -jef"permissive mode is a available a compromise"spaleta
>  
becarefull here! i do test things in fedora (9) and i do report issues
and make suggestions. you can't blame me for not testing something
that i:
1. don't like
2. don't want to have this way
3. don't want to spend my time on

And if you blame me for that than that's your problem!

2008/4/1, David Mansfield <fedora(a)dm.cobite.com&gt;:
>   On Mon, 2008-03-31 at 17:58 -0800, Jeff Spaleta wrote:
>   >
>   >
>   > On Mon, Mar 31, 2008 at 5:13 PM, Mark <markg85(a)gmail.com&gt; wrote:
>   >         Selinux keeps proving me that it deserves to shut down. i
>   >         can't help
>   >         it that it blames me for playing flash animation, using a gif
>   >         animation in a local web folder or oven just installing
>   >         updates from
>   >         fedora itself..
>   >
>   >
>   >
>   > Actually you CAN help.. you CAN help by taking the hint i provided earlier and
> start talking to people through the test list so we can troubleshoot the specific messages
> you have been seeing..instead of doing what you are doing right now, which is failing to
> communicate with enough specificity for anyone to confirm or help track down so
>
>
>  Hey, to extend this 'you can help' thing, is it possible that a
>   smolt-like setroubleshoot logger could be installed which automatically
>   (after asking for permission of course) posts the denials to a database
>   so developers could see statistics, say, after a big batch of updates?
>
>   I think one thing that's frustrating is to have to open a bugzilla for
>   each and every one.  It's way too much work.  There needs to be a
>   specific way to address these 'bogus' denails and get the updated
>   policies in a streamlined manner, IMHO.
>
>   David 
Now that's a great idea! if that was in it now that i would have
turned selinux oin right away just to fill up that database with all
the notices i get ;) seriously.. i would turn it on to submit those
notices.

And something else with selinux.. I think it's bad to ask of users to
relabel it or even to ask users tu run commands to prevent certain
things to happen. Normal new users (who don't know much of linux yet)
might be scared by things like this and might switch from fedora to
another os that doesn't bother the user with those messages
(ubuntu/windows/mac). So that might be something interesting to
investigate..?

[Stephen John Smoogen]

On Tue, Apr 1, 2008 at 7:46 AM, Mark <markg85(a)gmail.com&gt; wrote:
>  2008/4/1, Jeff Spaleta <jspaleta(a)gmail.com&gt;: 
>   > Actually you CAN help.. you CAN help by taking the hint i
> provided earlier
>   > and start talking to people through the test list so we can troubleshoot the
>   > specific messages you have been seeing..instead of doing what you are doing
>   > right now, which is failing to communicate with enough specificity for
>   > anyone to confirm or help track down so things can be fixed.  Clearly you've
>   > made up you mind... you decided you don't WANT to help. That's fine..
> that's
>   > your choice... but do so with the understanding that by doing so you cheapen
>   > the testing process that the pre-releases is meant to fulfill.  By choosing
>   > to ignore selinux completely, you certainly aren't living up to the implied
>   > agreement to act as a responsible tester when you chose to make use of the
>   > pre-releases.
>   >   -jef"permissive mode is a available a compromise"spaleta
>   >
>
>   becarefull here! i do test things in fedora (9) and i do report issues
>   and make suggestions. you can't blame me for not testing something
>   that i:
>   1. don't like
>   2. don't want to have this way
>   3. don't want to spend my time on
>
>   And if you blame me for that than that's your problem!
>  
Well that's one way to look at it. Of course, another way is to use
"Permissive Mode" or turn off Selinux when you install the system (it
was a choice ). That way, you can test what you want to test and avoid
what you hate. Not doing that and posting rants about what you think
about not doing it could be seen as being your problem.




-- 
Stephen J Smoogen. -- CSIRT/Linux System Administrator
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"

[Andrew Farris]

Mark wrote:
>  Selinux keeps proving me that it deserves to shut down. i can't
> help
>  it that it blames me for playing flash animation, using a gif
>  animation in a local web folder or oven just installing updates from
>  fedora itself.. 
btw, adobe flash works just fine with updated selinux policy, as long as you 
install it right:
go to adobe.com, download yum repo rpm from adobe (their .repo file), install 
the rpm, then
yum install libflashsupport nsplugin-wrapper
start firefox and hit youtube.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Andrew Farris]

Andrew Farris wrote:
>  go to adobe.com, download yum repo rpm from adobe (their .repo file),
>
>  install the rpm, then
>  yum install libflashsupport nspluginwrapper
>  start firefox and hit youtube. 
Fixed nspluginwrapper.  If you're on x86_64 install the i386 versions too.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Matthew Miller]

On Mon, Mar 31, 2008 at 05:48:31PM -0700, Andrew Farris wrote:
>  An assumption that is dangerous.  I understand prior bad selinux
> issues can 
>  leave you feeling that way, but consider how similar it is to just 'click 
>  ok for everything' in Windows?  Yes.. prior experience would tell you its 
>  something you have to do for it to work, but its also exploited by 
>  malicious code.  Assuming every selinux audit is a bug or just selinux 
>  being annoying is a terrible mindset. 
Err, yes. So the $64,000 dollar question is:How can we prevent SELinux from
imparting that mindset upon nearly everyone who uses it? Not by telling
them to run something and file dozens of bug reports, that's for sure.



-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

[Matej Cepl]

On 2008-04-01, 00:24 GMT, Mark wrote:
>  Well i'm not saying that Fedora beta has selinux bugs. just 
>  that till now my experience with selinux has been bad and 
>  i have to turn it off to have a normally functional desktop.
>  And i've seen selinux for at least a few years now in distributions
>  and there is always something wrong (perhaps not a bug but it annoys
>  the user) so i doubt that it will ever get "normal" (at a point where
>  i can just use the desktop without selinux asking my attention). 
I have been running (if possible) SELinux in the enforcing mode 
for couple of months with Rawhide (and F8 where I had almost no 
problems) and although I had to learn how to use audit2allow, and 
it could add spiceness to your life ;-) -- I was able to use my 
computers pretty well.

Just to note, you don't have to ever switch SELinux completely 
off, setting it to the Permissive mode is still much more 
valuable (because you may be able to file bugs when necessary) 
and should as painless as running with selinux=0.

Matej

[Andrew Farris]

Mark wrote:
>  Hey,
>  
>  I just installed the Fedora 9 Beta release and am doing a full system
>  update as we speak.
>  While downloading the updates nothing is wrong.. it just downloads and
>  that's it. But when installing the updates i get a ton of selinux
>  notices!! and this is just a default Fedora 9 beta followed by a yum
>  -y update. 
A few suggestions... first, this is beta software, so naturally the fresh beta 
install is going to have some issues.  Why wouldn't you expect that it is 
possible selinux wouldn't play quietly in its corner right after you install... 
yet you probably wouldn't think twice about a few little issues with gdm or 
nautilus?

Now suggestions.
- To keep selinux running nicely on your desktop you need to relabel or 
restorecon your files frequently, especially after any updates are done.  If you 
update selinux-policy or your kernel, immediately do 'touch /.autorelabel' and 
then reboot... when you don't you're tempting selinux to annoy you with denials 
(expected behavior).
- Use tmpfs for /tmp.  This one suggestion from Dan Walsh has been very helpful 
for my systems.  Just add the following line to your /etc/fstab:
tmpfs  /tmp  tmpfs  defaults 0 0

  then do:
rm -Rf /tmp/*; reboot

Then remember that files in tmp are supposed to be temporary and don't save 
large downloads, misc files, etc, in tmp... they will disappear at reboot, and 
tmp is only 512Mb with tmpfs defaults.

- Run selinux-policy-targeted (the default, so don't change it) and then learn a 
little bit about what denials mean, why they happen, and report those that you 
cannot figure out.  Use setroubleshoot and sealert.  I've got lots of denials in 
my audit database right now (actually 30+ of them are new today, for various 
stuff I've been testing)... but not one of them has stopped me from 'doing real 
work' on the system.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[James Morris]

On Tue, 1 Apr 2008, Mark wrote:

>  Btw.. justging from the selinux stats here:
>  http://smolts.org/static/stats/stats.html it says that nearly 50%
>  (48.4%) is turning off selinux. And my guess is that all fedora
>  servers keep it on making up the other 50%. 
Unfortunately, the raw statistics you see there are misleading, as they 
include a large number of machines which do not report SELinux status at 
all, and which are counted then as being disabled.  The actual figure is 
likely to be somewhat higher.

Mike, can we get a disclaimer added to this page?



Thanks,


-- 
James Morris <jmorris(a)namei.org&gt;

[Arthur Pemberton]

Here's what people asking for the removal of SELinux don't seem to understand.


When you remove SELinux, those of use who want to have it essentially
can't have it (yes you can always recompile yourself). When you leave
SELinux in, those of you who don't want it can simply turn it off.

Bad example, but it's like deciding whether or not to put a light bulb
in a room. If there is no light bulb, no one can have light. If there
is one, you can always just switch it off when you don't want light.

[Mark]

2008/4/3, Arthur Pemberton <pemboa(a)gmail.com&gt;:
>  Here's what people asking for the removal of SELinux don't
> seem to understand.
>
>
>   When you remove SELinux, those of use who want to have it essentially
>   can't have it (yes you can always recompile yourself). When you leave
>   SELinux in, those of you who don't want it can simply turn it off.
>
>   Bad example, but it's like deciding whether or not to put a light bulb
>   in a room. If there is no light bulb, no one can have light. If there
>   is one, you can always just switch it off when you don't want light. 
To stay on your light bulb.
It might not be the best thing to show down the light bulb like
Mr.Bean does in one of his videos so having the light bulb BUT turning
it off by default is better for the environment :) only turn it on
when you need the light.

and for that fedora needs to change the current state of that light
bulb from on to off by default

[Rahul Sundaram]

Mark wrote:
>  2008/4/3, Arthur Pemberton <pemboa(a)gmail.com&gt;:
> > Here's what people asking for the removal of SELinux don't seem to
> understand.
> >
> >
> >  When you remove SELinux, those of use who want to have it essentially
> >  can't have it (yes you can always recompile yourself). When you leave
> >  SELinux in, those of you who don't want it can simply turn it off.
> >
> >  Bad example, but it's like deciding whether or not to put a light bulb
> >  in a room. If there is no light bulb, no one can have light. If there
> >  is one, you can always just switch it off when you don't want light.
>  
>  To stay on your light bulb.
>  It might not be the best thing to show down the light bulb like
>  Mr.Bean does in one of his videos so having the light bulb BUT turning
>  it off by default is better for the environment :) only turn it on
>  when you need the light. 
Security is needed and hence different features to help support that need.

http://fedoraproject.org/wiki/Security/Features

Rahul

[Stewart Adam]

On Fri, 2008-04-04 at 19:18 +0200, Mark wrote:
>  2008/4/3, Arthur Pemberton <pemboa(a)gmail.com&gt;:
>  
>  To stay on your light bulb.
>  It might not be the best thing to show down the light bulb like
>  Mr.Bean does in one of his videos so having the light bulb BUT turning
>  it off by default is better for the environment :) only turn it on
>  when you need the light.
>  
>  and for that fedora needs to change the current state of that light
>  bulb from on to off by default
>   
+1

I don't use SELinux and I understand that some people like it and do
need/use it, however keeping it enabled by default causes a whole lot of
problems from the end-user point of view and I think we need the right
tools to fix these things.

I haven't extensively used SELinux in a long time so excuse me if this
already exists, but if we are to keep this enabled by default and want
it to be attractive to users I think we need to spend more time on tools
like setroubleshoot. Two problems I had when I played with SELinux a few
months ago was sharing content in /home via Samba, and /var/www/html via
Apache - Both of which are relatively trivial in Mac or Windows. Apache
+Windows less so, but at least it doesn't require the command line.

Setroubleshoot was a great help since I could just copy+paste the
command it gave me and then things worked a little better (until I hit
the next slew of audit errors). Printing out the error messages and
giving a error description + command to fix the error is great (huge
improvement since I last tried SELinux in FC2) but I think we need a
user-oriented tool that simply recognizes: SELinux is blocking Samba.
Click here to allow. <click>. done.

The idea is actually pretty similar to how Firestarter detects blocked
packets and you can right-click an event and to choose allow host, allow
service, block host, block service.

Another idea would be to implement a daemon that reports audit messages
to a central database where we could collect and review the cause. That
way we could pick up the common ones and get them solved or put why it's
being blocked by default into a FAQ. Of course, that daemon doesn't have
to be enabled by default, but it would be very useful among testers
imho,

Stewart

[Matej Cepl]

On Fri, 04 Apr 2008 17:17:43 -0400, Stewart Adam scripst:
>  I haven't extensively used SELinux in a long time so excuse me if
> this
>  already exists, but if we are to keep this enabled by default and want
>  it to be attractive to users I think we need to spend more time on tools
>  like setroubleshoot. Two problems I had when I played with SELinux a few
>  months ago was sharing content in /home via Samba, and /var/www/html via
>  Apache - Both of which are relatively trivial in Mac or Windows. Apache
>  +Windows less so, but at least it doesn't require the command line. 
OK, so this message sent me into overdrive mode (and sorry, if the tone 
of my reply will show it). This is really the example message of somebody 
who didn't get it or you had really bad day when you wrote it (yes, we 
all have such days).

So, let me restate the situation if I understand it correctly -- you are 
administering a network of computers with a Linux server (you may be even 
paid to do it, who knows?) and you are not willing to type into Yahoo! 
(or Google, results are almost the same) "samba selinux home". And guess 
what is the first hit in the results? And if you take a look at http://
fedoraproject.org/wiki/SELinux/samba you may find out that actually this 
is web representation of manpage selinux_samba(8) (who would guess such 
name?) which is already present in your box. So, that's the one.

Then we have this program called system-config-selinux (how unusal name 
for the system configuration program in Fedoraland, isn't it? Yes, it is 
new in Fedora 8, before that it had different name). And if you switch to 
"Booleans" table and write "samba" in the search box, what do you see?

"Support SAMBA home directories" and many other samba related switches (I 
am not sure which way your sharing of /home directories goes, so I am not 
sure, which is the best for you). Hmm, isn't that interesting?

OK, so you don't use Google, IRC (#fedora or #selinux channels on 
FreeNode), installed manapges, or many other methods how to get the 
information. So, what's your reaction? "SELinux is too complicated and it 
should be switched off by default!". No, sir, if you want to screw up 
security of computers you manage, YOU should switch off security features 
present there, so that YOU are responsible for the consequences. 
Otherwise, we would have hords of people with hijacked and broken-into 
boxes screaming here how Fedora is broken, because it doesn't protect 
their computer against known security threats.

</mode type="aggressive">

(I haven't understood what's your problem with Apache, so I cannot 
comment on that.)

You don't have to know that your other idea (red button "Just allow it!") 
is really not a great idea either. On the one hand you have Internet full 
of testimonies of people who hate Windows Vista for torturing them with 
dialog boxes "Can I do it? [Yes] [No]". On the other hand, if you are 
interested, read this http://www.cs.auckland.ac.nz/~pgut001/pubs/
phishing.pdf -- it is a good read.

Good luck with your administering!

Matěj

[Andrew Farris]

Matej Cepl wrote:
>  Then we have this program called system-config-selinux (how unusal
> name 
>  for the system configuration program in Fedoraland, isn't it? Yes, it is 
>  new in Fedora 8, before that it had different name). And if you switch to 
>  "Booleans" table and write "samba" in the search box, what do you
> see? 
>  "Support SAMBA home directories" and many other samba related switches (I 
>  am not sure which way your sharing of /home directories goes, so I am not 
>  sure, which is the best for you). Hmm, isn't that interesting? 
To be fair, even if you toggle those booleans right now you might have problems 
getting home directories to share, or worse yet you might toggle those OFF and 
still have your home being shared while you can't manage to get other shares to 
work.  (my current predicament)

Something is not quite right, but I haven't had the time to dig enough and get a 
good bug report on it.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Stewart Adam]

As I said, I don't use SELinux extensively so that's why I don't know
all the tools/solutions that are out there. But just for the record,
this was a home server (so obviously not paid) and I did do research - I
wrote a howto on turning audit messages into custom policy rules/modules
once I figured out how to use audit2allow and semodule.

First, let me say that I agree with you - SELinux is a good thing, and
Google makes solving a lot of problems pretty easy... As long as you are
comfortable with the command line or the SELinux tools. My point wasn't
that SELinux is bad, or that people can't use system-config-selinux.
Rather, I'm trying to point out that from the end-user point of view
Fedora is broken right now, nevermind once their system has been
compromised.

Macs and Windows can share documents in a Public folder quite easily.
Both have their fair share of problems, but forget about that for now.
Fedora offers various tools to make file sharing easy and painless. If
it doesn't work when a user has added shares and click OK, Fedora
appears to be broken to them. Instead of dealing with complicated audit
messages, doing an hour or two of research to find out what each means,
yes - that "red button" accompanied by a clear, easy to understand
message may be a good thing. If a user wants to share a path in /home
and we know that causes a potential conflict, then a simple solution is
to warn the user about it instead of letting it fail:
_____________________________________________________________________________________________
| One or more of the shares you have configured are located in the /home
directory. Sharing |
| files in /home may be blocked by SELinux. Would you like to grant
Samba the permission to |
| share files in /home?
|
|
________________________________________________________________________[ No ]____[ Yes
]__|

It comes down to this: The end user likes to have things just work.
Developers want to do things properly (ie, fast, secure and efficient).
If we can integrate SELinux with our configuration tools so the two are
aware of each other then problem solved.

Stewart

On Sat, 2008-04-05 at 10:06 +0200, Matej Cepl wrote:
>  On Fri, 04 Apr 2008 17:17:43 -0400, Stewart Adam scripst:
>  > I haven't extensively used SELinux in a long time so excuse me if this
>  > already exists, but if we are to keep this enabled by default and want
>  > it to be attractive to users I think we need to spend more time on tools
>  > like setroubleshoot. Two problems I had when I played with SELinux a few
>  > months ago was sharing content in /home via Samba, and /var/www/html via
>  > Apache - Both of which are relatively trivial in Mac or Windows. Apache
>  > +Windows less so, but at least it doesn't require the command line.
>  
>  OK, so this message sent me into overdrive mode (and sorry, if the tone 
>  of my reply will show it). This is really the example message of somebody 
>  who didn't get it or you had really bad day when you wrote it (yes, we 
>  all have such days).
>  
>  So, let me restate the situation if I understand it correctly -- you are 
>  administering a network of computers with a Linux server (you may be even 
>  paid to do it, who knows?) and you are not willing to type into Yahoo! 
>  (or Google, results are almost the same) "samba selinux home". And guess 
>  what is the first hit in the results? And if you take a look at http://
>  fedoraproject.org/wiki/SELinux/samba you may find out that actually this 
>  is web representation of manpage selinux_samba(8) (who would guess such 
>  name?) which is already present in your box. So, that's the one.
>  
>  Then we have this program called system-config-selinux (how unusal name 
>  for the system configuration program in Fedoraland, isn't it? Yes, it is 
>  new in Fedora 8, before that it had different name). And if you switch to 
>  "Booleans" table and write "samba" in the search box, what do you
> see? 
>  "Support SAMBA home directories" and many other samba related switches (I 
>  am not sure which way your sharing of /home directories goes, so I am not 
>  sure, which is the best for you). Hmm, isn't that interesting?
>  
>  OK, so you don't use Google, IRC (#fedora or #selinux channels on 
>  FreeNode), installed manapges, or many other methods how to get the 
>  information. So, what's your reaction? "SELinux is too complicated and it 
>  should be switched off by default!". No, sir, if you want to screw up 
>  security of computers you manage, YOU should switch off security features 
>  present there, so that YOU are responsible for the consequences. 
>  Otherwise, we would have hords of people with hijacked and broken-into 
>  boxes screaming here how Fedora is broken, because it doesn't protect 
>  their computer against known security threats.
>  
>  </mode type="aggressive">
>  
>  (I haven't understood what's your problem with Apache, so I cannot 
>  comment on that.)
>  
>  You don't have to know that your other idea (red button "Just allow it!") 
>  is really not a great idea either. On the one hand you have Internet full 
>  of testimonies of people who hate Windows Vista for torturing them with 
>  dialog boxes "Can I do it? [Yes] [No]". On the other hand, if you are 
>  interested, read this http://www.cs.auckland.ac.nz/~pgut001/pubs/
>  phishing.pdf -- it is a good read.
>  
>  Good luck with your administering!
>  
>  Matěj
>

[Stewart Adam]

> _____________________________________________________________________________________________
>  | One or more of the shares you have configured are located in the /home
>  directory. Sharing |
>  | files in /home may be blocked by SELinux. Would you like to grant
>  Samba the permission to |
>  | share files in /home? 
Hm, that didn't turn out to well - The dialog box was
supposed to read:

One or more of the shares you have configured are located in the /home
directory. Sharing files in /home may be blocked by SELinux. Would you
like to grant Samba permission to share files in /home?
        [ No ] [ Yes ]

Stewart

[gopal das]

I am using SELinux from fedora core 6 and I its working fine. I have
installed many packages through yum and its also fine. Though whenever I
installed a fedora or red hat based os then I change the selinux to
permissive after the first time installation.

Cheers
Gopal Das

On Tue, Apr 1, 2008 at 4:50 AM, Mark <markg85(a)gmail.com&gt; wrote:

>  Hey,
>
>  I just installed the Fedora 9 Beta release and am doing a full system
>  update as we speak.
>  While downloading the updates nothing is wrong.. it just downloads and
>  that's it. But when installing the updates i get a ton of selinux
>  notices!! and this is just a default Fedora 9 beta followed by a yum
>  -y update.
>
>  Also another issue that i noticed was when looking at a flash
>  animation in firefox.. when i want to play the animation selinux
>  (again) drops in and tells me i can't. (or i need to run a command to
>  get it working).
>
>  Now i've tried to run selinux on Fedora 7 and 8 for as long as
>  possible just to see how long i can get around it.. i did some
>  commands in that time as well but i always end up with disabling
>  selinux.
>
>  I have no idea how other users are using fedora in a normal every day
>  usage without disabling selinux.. i agree that a firewall should be in
>  linux but selinux just doesn't seem mature yet (if it will ever be).
>  Perhaps it's time to start considering to turn off selinux and remove
>  it out of the fedora kernel completely? As long as it's blaming here
>  when i install updates or simply browse the web than selinux gets shut
>  down completely!
>
>  So.. how are you doing this?
>
>
>  Btw.. justging from the selinux stats here:
>  http://smolts.org/static/stats/stats.html it says that nearly 50%
>  (48.4%) is turning off selinux. And my guess is that all fedora
>  servers keep it on making up the other 50%.
>
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mark wrote:
>  Hey,
>  
>  I just installed the Fedora 9 Beta release and am doing a full system
>  update as we speak.
>  While downloading the updates nothing is wrong.. it just downloads and
>  that's it. But when installing the updates i get a ton of selinux
>  notices!! and this is just a default Fedora 9 beta followed by a yum
>  -y update.
>  
>  Also another issue that i noticed was when looking at a flash
>  animation in firefox.. when i want to play the animation selinux
>  (again) drops in and tells me i can't. (or i need to run a command to
>  get it working).
>  
>  Now i've tried to run selinux on Fedora 7 and 8 for as long as
>  possible just to see how long i can get around it.. i did some
>  commands in that time as well but i always end up with disabling
>  selinux.
>  
>  I have no idea how other users are using fedora in a normal every day
>  usage without disabling selinux.. i agree that a firewall should be in
>  linux but selinux just doesn't seem mature yet (if it will ever be).
>  Perhaps it's time to start considering to turn off selinux and remove
>  it out of the fedora kernel completely? As long as it's blaming here
>  when i install updates or simply browse the web than selinux gets shut
>  down completely!
>  
>  So.. how are you doing this?
>  
>  
>  Btw.. justging from the selinux stats here:
>  http://smolts.org/static/stats/stats.html it says that nearly 50%
>  (48.4%) is turning off selinux. And my guess is that all fedora
>  servers keep it on making up the other 50%.
>   
The AVC messages you are probably seeing is SELinux attempting to
confine firefox/nsplugins. Although you did not submit them.

During the Beta I have been turning on a transition boolean for
nsplugin.  This transition is from unconfined_t to nsplugin_t.  The
attempt here is to confine random code like flashplugin/acrobat and
other closed source programs that read random data from the internet
from attacking your machine.  I have to turn it on by default in
Rawhide/Beta to find out what problems it causes.  I will probably turn
it off when we release, to prevent it causing problems, for people like you.

I write about the change in

danwalsh.livejournal.com/15700.html

This is a potential real security gain from this, but we need to
experiment to figure out how we can benefit the greatest number of users.

I agree we need to tread lightly when adding new SELinux confinement, to
the users but we still have an ability that could really advance
computer security.

allow_execmod, allow_execstack, allow_execheap, allow_execmod have
caused many avc's to be seen by users, but they also can prevent buffer
overflow attacks.  Sadly badly coded applications have caused us to turn
a lot of these checks off by default.

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkf3XKYACgkQrlYvE4MpobNo9QCg2QrrCMTnlu2t7tjv+Eefaf5w
> foEAoKjX9c3UmowjVAsuCf5hZe4LmXA+
> =PcR3
> -----END PGP SIGNATURE-----

[Rahul Sundaram]

Daniel J Walsh wrote:

>  During the Beta I have been turning on a transition boolean for
>  nsplugin.  This transition is from unconfined_t to nsplugin_t.  The
>  attempt here is to confine random code like flashplugin/acrobat and
>  other closed source programs that read random data from the internet
>  from attacking your machine.  I have to turn it on by default in
>  Rawhide/Beta to find out what problems it causes.  I will probably turn
>  it off when we release, to prevent it causing problems, for people like you.
>  
>  I write about the change in
>  
>  danwalsh.livejournal.com/15700.html
>  
>  This is a potential real security gain from this, but we need to
>  experiment to figure out how we can benefit the greatest number of users.
>  
>  I agree we need to tread lightly when adding new SELinux confinement, to
>  the users but we still have an ability that could really advance
>  computer security. 
Please send a note to fedora-devel/fedora-test list when making 
important changes like this so people know what to expect and can give 
feedback accordingly.

Rahul

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rahul Sundaram wrote:
>  Daniel J Walsh wrote:
>  
> > During the Beta I have been turning on a transition boolean for
> > nsplugin.  This transition is from unconfined_t to nsplugin_t.  The
> > attempt here is to confine random code like flashplugin/acrobat and
> > other closed source programs that read random data from the internet
> > from attacking your machine.  I have to turn it on by default in
> > Rawhide/Beta to find out what problems it causes.  I will probably turn
> > it off when we release, to prevent it causing problems, for people
> > like you.
> >
> > I write about the change in
> >
> > danwalsh.livejournal.com/15700.html
> >
> > This is a potential real security gain from this, but we need to
> > experiment to figure out how we can benefit the greatest number of users.
> >
> > I agree we need to tread lightly when adding new SELinux confinement, to
> > the users but we still have an ability that could really advance
> > computer security.
>  
>  Please send a note to fedora-devel/fedora-test list when making
>  important changes like this so people know what to expect and can give
>  feedback accordingly.
>  
>  Rahul
>   
Well I actually misspoke, this has been on for the entire Rawhide period
after FC8 shipped.  I will be turning it off by default with the
shipping Fedora 9.


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkf3lRIACgkQrlYvE4MpobP8aACggcAiO5aS/jowKe3qyYMSWyi6
> ISIAoIXPTjBP5qvJz/MR8ClDSKWCoSBg
> =wCAu
> -----END PGP SIGNATURE-----

[Mark]

2008/4/5, Daniel J Walsh <dwalsh(a)redhat.com&gt;:
>  -----BEGIN PGP SIGNED MESSAGE-----
>   Hash: SHA1
>
>
>   Mark wrote:
>   > Hey,
>   >
>   > I just installed the Fedora 9 Beta release and am doing a full system
>   > update as we speak.
>   > While downloading the updates nothing is wrong.. it just downloads and
>   > that's it. But when installing the updates i get a ton of selinux
>   > notices!! and this is just a default Fedora 9 beta followed by a yum
>   > -y update.
>   >
>   > Also another issue that i noticed was when looking at a flash
>   > animation in firefox.. when i want to play the animation selinux
>   > (again) drops in and tells me i can't. (or i need to run a command to
>   > get it working).
>   >
>   > Now i've tried to run selinux on Fedora 7 and 8 for as long as
>   > possible just to see how long i can get around it.. i did some
>   > commands in that time as well but i always end up with disabling
>   > selinux.
>   >
>   > I have no idea how other users are using fedora in a normal every day
>   > usage without disabling selinux.. i agree that a firewall should be in
>   > linux but selinux just doesn't seem mature yet (if it will ever be).
>   > Perhaps it's time to start considering to turn off selinux and remove
>   > it out of the fedora kernel completely? As long as it's blaming here
>   > when i install updates or simply browse the web than selinux gets shut
>   > down completely!
>   >
>   > So.. how are you doing this?
>   >
>   >
>   > Btw.. justging from the selinux stats here:
>   > http://smolts.org/static/stats/stats.html it says that nearly 50%
>   > (48.4%) is turning off selinux. And my guess is that all fedora
>   > servers keep it on making up the other 50%.
>   >
>
>  The AVC messages you are probably seeing is SELinux attempting to
>   confine firefox/nsplugins. Although you did not submit them.
>
>   During the Beta I have been turning on a transition boolean for
>   nsplugin.  This transition is from unconfined_t to nsplugin_t.  The
>   attempt here is to confine random code like flashplugin/acrobat and
>   other closed source programs that read random data from the internet
>   from attacking your machine.  I have to turn it on by default in
>   Rawhide/Beta to find out what problems it causes.  I will probably turn
>   it off when we release, to prevent it causing problems, for people like you.
>
>   I write about the change in
>
>   danwalsh.livejournal.com/15700.html
>
>   This is a potential real security gain from this, but we need to
>   experiment to figure out how we can benefit the greatest number of users.
>
>   I agree we need to tread lightly when adding new SELinux confinement, to
>   the users but we still have an ability that could really advance
>   computer security.
>
>   allow_execmod, allow_execstack, allow_execheap, allow_execmod have
>   caused many avc's to be seen by users, but they also can prevent buffer
>   overflow attacks.  Sadly badly coded applications have caused us to turn
>   a lot of these checks off by default.
>  
hereby a promise from me to you and all of the fedora development team.
Next time i install fedora (9 final or even 10 rawhide) then i will
keep selinux on as long as possible on enforcing.

Then i will collect all the issues i find and file them all here in
this mailing list (no this thread). i won't make a bugzilla report for
each warning! and a online selinux warning database where all the
warning are send to would really be helpful here!

But for now it stays off till i reinstall.

[Andrew Farris]

Mark wrote:
>  Then i will collect all the issues i find and file them all here in
>  this mailing list (no this thread). i won't make a bugzilla report for
>  each warning! and a online selinux warning database where all the
>  warning are send to would really be helpful here! 
Sending to fedora-selinux-list or fedora-test-list rather than flooding 
devel-list with AVCs will be much more helpful, when you do this.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Andrew Farris wrote:
>  Mark wrote:
> > Then i will collect all the issues i find and file them all here in
> > this mailing list (no this thread). i won't make a bugzilla report for
> > each warning! and a online selinux warning database where all the
> > warning are send to would really be helpful here!
>  
>  Sending to fedora-selinux-list or fedora-test-list rather than flooding
>  devel-list with AVCs will be much more helpful, when you do this.
>   
Grouping all the AVC messages into one Bugzilla is fine.  Most people do
this.  It is actually easier on me.  Flooding the list with the messages
is not a good idea.  You could all use a pastebin.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkf3nAMACgkQrlYvE4MpobOO4wCgg2B6UW/UPv1btm4OeTvnTDxE
> YXgAoMfFtFsex2TDTFc8icxuL1BaPngH
> =6rfG
> -----END PGP SIGNATURE-----

[Mark]

2008/4/5, Andrew Farris <lordmorgul(a)gmail.com&gt;:
>  Mark wrote:
>
>  > Then i will collect all the issues i find and file them all here in
>  > this mailing list (no this thread). i won't make a bugzilla report for
>  > each warning! and a online selinux warning database where all the
>  > warning are send to would really be helpful here!
>  >
>
>   Sending to fedora-selinux-list or fedora-test-list rather than flooding
>  devel-list with AVCs will be much more helpful, when you do this. 
I will send it to both those lists and keep the devel list out of it (for now).


2008/4/5, Daniel J Walsh <dwalsh(a)redhat.com&gt;:
>  -----BEGIN PGP SIGNED MESSAGE-----
>   Hash: SHA1
>
>
>  Andrew Farris wrote:
>   > Mark wrote:
>   >> Then i will collect all the issues i find and file them all here in
>   >> this mailing list (no this thread). i won't make a bugzilla report for
>   >> each warning! and a online selinux warning database where all the
>   >> warning are send to would really be helpful here!
>   >
>   > Sending to fedora-selinux-list or fedora-test-list rather than flooding
>   > devel-list with AVCs will be much more helpful, when you do this.
>   >
>
>  Grouping all the AVC messages into one Bugzilla is fine.  Most people do
>   this.  It is actually easier on me.  Flooding the list with the messages
>   is not a good idea.  You could all use a pastebin. 
I will also do that!

Now just to group it together.
Just to report issues you have to do (one/multiple or all):

- send a message to the test list
- send a message to the selinux-list
- file a bugzilla

And for that you need to subscribe to those lists or register to on
bugzilla. The later one isn't a issue because i already have a account
on bugzilla but the subscribing part is.. just getting more junk in my
gmail! And why do you guys make a list for everything.. you can overdo
it and this smells like overdoing it.

Also you see that there are 3 ways in reporting a bug. all 3 require
the user to put work in it to even start reporting the bug. If you
want more bugs to get filled than get rid of those subscription and
registration demands! Make a bug database for that selinux stuff.. add
a "report bug" button in selinux where the notices appear.. just do
something to get the users so far to submit more of those
notices/warning/whatever

This is the last time i'm gonna try selinux to help improve it!

[Andrew Farris]

Mark wrote:
>  Now just to group it together.
>  Just to report issues you have to do (one/multiple or all):
>  
>  - send a message to the test list
>  - send a message to the selinux-list
>  - file a bugzilla
>  
>  And for that you need to subscribe to those lists or register to on
>  bugzilla. The later one isn't a issue because i already have a account
>  on bugzilla but the subscribing part is.. just getting more junk in my
>  gmail! And why do you guys make a list for everything.. you can overdo
>  it and this smells like overdoing it. 
You don't have to be receiving the emails, you can disable delivery but still be 
subscribed to send.  Having subscription is important for helping to curb spam 
issues, and it lends some credibility as well.

You don't have to report to all 3 places, bugzilla is preferred and you could 
just do that only.

>  Also you see that there are 3 ways in reporting a bug. all 3 require
>  the user to put work in it to even start reporting the bug. If you
>  want more bugs to get filled than get rid of those subscription and
>  registration demands! Make a bug database for that selinux stuff.. add
>  a "report bug" button in selinux where the notices appear.. just do
>  something to get the users so far to submit more of those
>  notices/warning/whatever 
Could be useful for testing, but someone would need to develop the web 
application that can accept those reports.

-- 
Andrew Farris <lordmorgul(a)gmail.com&gt; www.lordmorgul.net
  gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB  5BD5 5F89 8E1B 8300 BF29
  revoked key 0xC99B1DF3 no longer used
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----

[Mark]

2008/4/7, Andrew Farris <lordmorgul(a)gmail.com&gt;:
>  Mark wrote:
>
>  > Now just to group it together.
>  > Just to report issues you have to do (one/multiple or all):
>  >
>  > - send a message to the test list
>  > - send a message to the selinux-list
>  > - file a bugzilla
>  >
>  > And for that you need to subscribe to those lists or register to on
>  > bugzilla. The later one isn't a issue because i already have a account
>  > on bugzilla but the subscribing part is.. just getting more junk in my
>  > gmail! And why do you guys make a list for everything.. you can overdo
>  > it and this smells like overdoing it.
>  >
>
>   You don't have to be receiving the emails, you can disable delivery but
>  still be subscribed to send.  Having subscription is important for helping
>  to curb spam issues, and it lends some credibility as well.
>
>   You don't have to report to all 3 places, bugzilla is preferred and you
>  could just do that only.
>
>
>  > Also you see that there are 3 ways in reporting a bug. all 3 require
>  > the user to put work in it to even start reporting the bug. If you
>  > want more bugs to get filled than get rid of those subscription and
>  > registration demands! Make a bug database for that selinux stuff.. add
>  > a "report bug" button in selinux where the notices appear.. just do
>  > something to get the users so far to submit more of those
>  > notices/warning/whatever
>  >
>
>   Could be useful for testing, but someone would need to develop the web
>  application that can accept those reports.
>
>  
IF it's allowed to be written in PHP than i could do it for you.
tell me what you need (functions) and how it's gonna be delivered (the
report) and i can make it.