> Turns out that doing crazy shit like letting users have their html files in ~/public_html/ requires a lot of SELinux configuration I guess "setsebool httpd_e

> Turns out that doing crazy shit like letting users have their html files in ~/public_html/ requires a lot of SELinux configuration I guess "setsebool httpd_enable_homedirs on" would do that. > Also turns out that there isn't a tool which tells you what new rules are needed, relative to the existing configuration, for recent SELinux denies setroubleshoot should be shipped with RedHat-based distros. Mentioned in https://youtu.be/cNoVgDqqJmM https://youtu.be/cNoVgDqqJmM Besides that, there's domain-based switch-off command, "semanage permissive --add programname_t" > 111 lines of perl and 116 lines of SELinux rules later, I was in good shape. I paid a SELinux developer and just nice guy from #gentoo-hardened, perfinion, to help me with setting up my workstations so that I could run untrusted crap like skype in enforced mode. After that, I was in good shape and full of warm cozy safe feeling. And now I can use SELinux hardening stuff at my job.