3 ms·
Sure, but I think Red Hat has done a good job of simplifying things -- the SELinux booleans are pretty straightforward (e.g. "httpd_execmem" is probably somethi
by betterunix 14y ago
Sure, but I think Red Hat has done a good job of simplifying things -- the SELinux booleans are pretty straightforward (e.g. "httpd_execmem" is probably something you want to keep off), the included users/roles are fairly useful, and the labels more or less make sense. For desktops, the sandbox tool is pretty handy.
If you need something more complicated, I can see it being difficult (having sweated through the process myself).
- astrodust 14y agoIf you say something like "httpd_execmem" you've already lost me. That is not straight-forward, that's Byzantine. RedHat has tried to make this thing more usable, but it's still a greasy pig to wrestle. Applications just mysteriously "don't work" without explanation, and there's no obvious resolution to the problem. Although iptables is an example of an ornery configuration format, at least it's self-contained. SELinux seems to allow applications to define their own quirky rulesets which complicates things severely.
- druiid 14y agoThere will always be an explanation. Anything that 'pings' selinux is logged to audit.log. It might be difficult to decipher some of the rules being hit, but it's easy enough to work around them without disabling selinux wholesale. Look into audit2allow. It makes things MUCH simpler.