SELinux last straw

[Mikkel L. Ellertson]

Matthew Miller wrote:
> On Wed, Oct 17, 2007 at 02:19:55PM -0500, Les Mikesell wrote:
>>> 1) familiarize ones self with the rules , as one has to do with
>>> traditional secuirty
>> But the traditional unix rules are extremely simple, and being able to 
>> understand and verify them is one of their biggest virtues.
> 
> +1. Simplicity, transparency, security. It doesn't matter how high tech your
> complicated fence is if it's so complicated that you would have no chance of
> noticing if the gate were accidentally left open.
> 
The same argument could be applied to using IPtables for firewall
protection. After all, it you do not learn about IPtables rules, and
do not use one of the GUI tools, or predefined rule sets, it is easy
to have a hole and not know it. Unless you test it from the outside,
you could have a rule set the offers no protection at all, and never
know it.

Granted, the tools for SELinux are not as mature as the firewall
tools, but does that mean we throw out SELinux instead of improving
the tools? I thought one of the goals of Fedora was to improve the
tools. From what I see, the rule sets and tools for SELinux are
improving.

I have seen the same kind of arguments about just about every major
change. I remember people complaining about udev, and what was wrong
with using the standard /dev setup. I heard it about the change to
IPTables. I have heard it about HAL. Way too many of them boil down
to I know how the old system works, so why should I learn about this
new way of doing things. I am happy with the way things are working
now. Don't change things and make me learn a new method. I don't
care if this new method has advantages over the one I know.

Now, some of the new things are not going to work out, or in trying
to implement them, a better way may present itself. But if nobody is
willing to try the new methods, and work out the bugs that are
always going to crop up when trying something new, then there will
not be any progress.

I am not sure if most of the people arguing ageist SELinux
understand is that is is not primarily designed to stop people from
breaking into the system. It is designed to prevent, or at least
limit the damage after somebody gets in, or from somebody that
already has access. Defense in depth.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20071017/6800a85d/attachment-0001.bin