SELinux

[Guy Fraser]

On Thu, 2005-01-09 at 07:53 +0100, Paul Howarth wrote:
> On Wed, 2005-08-31 at 22:23 -0700, CHAT KHODA wrote:
> > Dear friends,
> > As you know new versions of fedora are comming with
> > SELinux feature.I wonder to know whether it is a good
> > idea to enable this feature on a web-mail server or
> > not? .Somebody advised me ;this feature will cause
> > disturbing circumstances,but I wish to know if you
> > have any comment.
> 
> A web/mail server is exactly the type of application that SELinux works
> well with. You may have difficulty at first understanding it (read
> http://fedora.redhat.com/docs/selinux-apache-fc3/ for a good start) but
> it's worth the effort.

Beware that SELinux is designed to provide a higher level of 
security than the standard file system and access controls 
built in to the applications. More specifically if you have 
anything that uses sendmail directly rather than using SMTP 
you will have problems. If possible configure you PHP, PERL 
or other software to use SMTP on localhost rather than 
using sendmail directly, it will save you some headaches.

Overall I have only had few problems with RHEL4 and FC3 with 
SELinux enabled, and most were simple to work around, and 
left the system more secure in the process.