<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body>
I've been following all the discussion on simplifying SELinux for the
next release of Fedora. It would seem that the first things to
strictly secure would be external attacks. With this, an easy to
understand policy how to for non-selinux people with an end user focus
would go a long way to helping people get started. Just my two cents
worth.<br>
<br>
<pre class="moz-signature" cols="72">Phil Parsons
<a class="moz-txt-link-abbreviated" href="mailto:philpar@swfla.rr.com">philpar@swfla.rr.com</a>
239-340-9880
</pre>
<br>
<br>
James Morris wrote:
<blockquote
cite="midXine.LNX.4.44.0405040058410.5935-100000@thoron.boston.redhat.com"
type="cite">
<pre wrap="">On Mon, 3 May 2004, Thomas Molina wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">an arbitrary number of 5 for now and are trying to figure out which are
the 5 daemons we would like to put in relaxed policy.
My ideas are
apache
bind
sendmail
ftp
ssh??? (Not sure this one is worth securing).
</pre>
</blockquote>
<pre wrap="">I am apparently not expressing myself well. My point is that if we are
relaxing policy to the point where you are relying on DAC, what is the
point? I want to test strict policy on those things where it most makes a
difference. In that vein, sendmail and bind are two which have
historically had a lot of problems. I would think those would be
candidates for stricter policy, not more permissive.
</pre>
</blockquote>
<pre wrap=""><!---->
There is a bit of confusion here, totally understandable.
The daemons referred to above are candidates for being strictly
controlled.
The term 'relaxed policy' here refers to the concept of providing very
strict policies for a small, critical subset of the system, then allowing
the rest of the system to be unconfined. It's relaxed in terms of not
trying to provide strict policies for every domain.
- James
</pre>
</blockquote>
</body>
</html>