On 13. nov. 2013 20:26, John Musbach wrote: > Maybe it's just me, but it seems like a serious failing of SELinux's > efforts when most people I've encountered in the Linux world have the > policy of just disabling SELinux in their images.
Not sure if this was intended as a fire torch or not, or I'm just being a bit sensitive. But I can turn it around: IPv6 has been available for over a decade (if not longer). Is it a failure of IPv6 that so few enables IPv6 in their networked environments?. Of course not. It's about convenience and resistance of changing your attitude to new technologies. But eventually you're forced to take the step. And it's been a similar situation with iptables (and firewalling in Windows, for that matter). People were mostly ignorant to the concept of firewalling, until they realised they had to implement it to have a more secure environment. Is iptables (or firewalling) considered a failure today? During EL6 installation, there is no way you can disable SELinux. It needs to be done explicitly afterwards. This is because SELinux is considered to work so well most users really don't need to think about it. Seriously. SELinux has also been available since EL4 and Fedora Core 3. SELinux is celebrating 10 years these days. It's not something brand new, but it is beginning to really gain traction. These days even SEAndroid is on the way (that is SELinux for Android). SELinux has developed a lot, and is far more easily available and usable today than it was 10 years ago. Please don't be afraid of it! To all of you SELinux sceptic, I have only this to say: If you first grasp the concept of labelling, SELinux isn't much more difficult than what iptables used to be in the beginning. And that article from Dan Walsh gives a very easy to understand introduction to SELinux. And seriously, unless you really have a really odd setup, SELinux will in not give you any troubles in EL6. I have set up roughly 20 different SL6.x servers the last years. I can't remember having had any real issues related to SELinux. This has been everything from LDAP servers, web servers (apache and nginx), e-mail servers (both postfix+amavis+spamassasin and Zimbra), database servers (both PostgreSQL and MySQL). I honestly can't remember having had much troubles with SELinux at all. If SELinux did kick in, it was usually just to flip some SELinux booleans (semanage boolean --list), modifying some network ports context (semanage port --list) or adding some extra paths for correct file labelling (semanage fcontext --list). Changing those things are really not more difficult than adding additional iptables rules. And to figure out if it is SELinux to blame: grep denied /var/log/audit/audit.log Really, stop disabling it! Try it for real and embrace SELinux now! kind regards, David Sommerseth > On Nov 13, 2013, at 2:17 PM, David Sommerseth > <sl+us...@lists.topphemmelig.net> wrote: > >> Hi all, >> >> As there has been a couple of SELinux discussions lately, I thought this >> article could help explain better what SELinux is all about and why it's >> such a great tool. >> >> It's written by one of the core SELinux guys in Red Hat, Daniel Walsh >> and illustrations by one of Fedora's UX designers, Máirín Duffy. >> >> "Your visual how-to guide for SELinux policy enforcement" >> <http://opensource.com/business/13/11/selinux-policy-guide> >> >> Hope you'll enjoy the reading :) >> >> >> -- >> kind regards, >> >> David Sommerseth >>