On Sat, Jan 17, 2015 at 4:54 AM, Andrew R Paterson <
andy.paterson(a)ntlworld.com> wrote:
Having watched this debate I find I must add my own 10c
I have spent over 30 years working on unix systems starting with xenix,
bsd
and ending up with linux .....
We survived quite happily using the well known DAC methods of standard
UNIX.
(UGO - RWX - setuid etc).
Then I worked on some military systems (high security stuff) and started
to use
SOLARIS CMW (Compartentalised Mode Workstation) and DEC MLS
(Multi-Level-
Security).
These both use the same (probably not as up to date) MAC security via
labelling as (I guess) selinux.
I can truthfully say I loved UNIX in all its forms until coming across
CMW &
MLS and now SELINUX - then basically - I wanted OUT!.
They are horrendous; if you start to use labelling in earnest - absolutely
suicidal!!! - unless you have a real motive - ie you work for the security
services or a bank or something and have a massive amount of time to
devote.
Why do the selinux guys have to force MAC onto all linux users -
even
hobbyists?
Here, maybe this is more your style for this subject:
https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf
Quite honestly I feel the same way about packaging on linux. I sorta
understand that it's necessary, like concrete needs cement, but I don't
want to interact with it at all. Every distribution reinvents this
particular wheel and makes me understand it's peculiarities when it comes
to packaging. It causes users, packagers, and upstream no end of grief. It
enhances my notion that distros are really different operating systems that
just so happen to share a kernel (and maybe some other stuff).
--
Chris Murphy