2 ms·
Yes and no. But the thing is... SELinux does complex stuff. You can simplify that, but only to a certain point. If you dumb it down too much it becomes useless
by znpy 3y ago
Yes and no. But the thing is... SELinux does complex stuff. You can simplify that, but only to a certain point.
If you dumb it down too much it becomes useless. Simple tools usually get their simplicity by making some choices for you. You don't always want that.
SELinux is one of those things where you don't want that.
That being said, without diving too much, I have configured many custom services to run under SELinux by just running them in a dev/staging environment, collecting violations and creating policies via the audit2allow tool. So yeah, things have improved I guess.
- deleted 3y ago[deleted]
- kbolino 3y agoIn my experience, SELinux is the sort of thing you avoid unless you're forced to use it, then when you are forced to use it, you're encouraged to stumble around until you get it out of your way, then forget about it until it gets in your way again. Good documentation and good tools would encourage more people to use it and understand it willingly and effectively.