4 ms·
I am (was - new job now) guilty of disabling selinux on the fleet of servers managed by puppet. I was hoping that the modules listed in the article would show t
by jsmeaton 10y ago
I am (was - new job now) guilty of disabling selinux on the fleet of servers managed by puppet. I was hoping that the modules listed in the article would show that configuring selinux is actually easy, but I came away with my opinions unchanged. selinux requires a fair amount of investment to deeply learn how it works and what the requirements are for a bunch of apps. As a developer casually working with the ops team to automate their configuration, I didn't have the time or inclination to undertake that learning for what I perceived to be only marginal improvements to our systems.
For what it's worth, that system had about 60 different applications we were running that were provided by a vendor, and their official recommendation was to disable selinux. They never provided (afaik) configurations or guidance to run their apps under selinux.
- joombaga 10y agoI'm guilty of the same, and in fact our corporate AMI has selinux disabled. Not my choice, though I'm at least complicit in that I've not protested. Vendor supported apps are the biggest issue. If we have any issues, selinux is the culprit until it's disabled. Even, after ruling it out, you can forget about vendor supported RCA if you turn selinux back on.
- coredog64 10y agoAfter reading the article, I looked up what level of support Amazon offers in their distribution. Near as I can tell? None.
- sysadmindotfail 10y agoOne compromise to consider is using the unconfined domain (unconfined_t) to offer a more flexible arrangement. Of course this won't help you in a compliance situation (like PCI/RMF/NIST) but it's worth considering. https://wiki.gentoo.org/wiki/SELinux/Tutorials/What_is_this_unconfined_thingie_and_tell_me_about_attributes https://wiki.gentoo.org/wiki/SELinux/Tutorials/What_is_this_...