SELinux

[Ralf Corsepius]

On 08/31/2010 02:26 PM, Tim wrote:
> On Mon, 2010-08-30 at 22:06 +0100, Alan Cox wrote:
>> As to software which demands you disable security, I always apply
>> common sense and treat it the same way as if a passing tradesman says
>> "can you just leave your door unlocked for the weekend"
>
> Likewise for people vehemently advocating to disable SELinux, I view
> them with a great deal of suspicion.  Is it simply they really do not
> like it, or do they have ulterior motives?
Neither. Initially, when trying to use it, they typically notice 
something stops working. Then, when trying to make it work, they get 
lost in arcane and cryptic tools.

To utilize Alan's ABS analogy: In most cases, the only UI ABS offers to 
end-users an on/off switch and "just works". SELinux however forces to 
fiddle and dig through 100s of knobs and switches.

In short: there is nothing fundamentally wrong with SELinux, except that 
its UIs and GUIs are not end-user-ready and that the Fedora SELinux 
policy packages suffer from bugs.

Ralf