3 ms·
i am embarrassed to say this but rather than configure SELinux to do those little things - like local mail delivery or open a new socket for httpd - i tend to j
by jnazario 14y ago
i am embarrassed to say this but rather than configure SELinux to do those little things - like local mail delivery or open a new socket for httpd - i tend to just disable it. i'll chalk it up to a usability problem on their part and not laziness to learn it on mine.
i'm familiar with it, i've written some policies in it, i remember when it was introduced. that said ... i don't use it.
- quicksilver03 14y agoYou shouldn't feel embarrassed, SELinux is so fine-grained that a proper configuration is very difficult to attain.
- andrewflnr 14y agoLaziness might be justified sometimes, but you may as well call it what it is.
- frost_knight 14y agoInstead of disabling it, consider putting it into permissive mode. It logs violations but doesn't enforce any rules. It's a good way to get a feel for what it's doing. You can tweak the rules, view the logs, tweak some more, and work up to a tight policy before enabling. Also, if you disable it, re-enabling requires that you relabel all of your files and reboot the system; the relabel process can take an impressive amount of time. Switching between eforcing and permissive can be done on the fly with the setenforce command, no reboot required. I do think that laziness is a virtue in a sysadmin when properly applied, but using selinux is in your best interest.