Another selinux rant

[Andrew Farris]

Jonathan Underwood wrote:
> The problem is: setroubleshoot teaches average users that avc denials
> come about due to bugs in selinux policy. If there was some massive
> security problem right now on my machine causing avc denials I'd
> probably react by filing a stack of bug reports. This is the
> fundamental problem as it stands with SElinux. If it was working, we
> would be in a situation where the first responce to an avc denial is
> "OMG there's a security issue with something running on my machine, I
> must fix that".

True enough, but that (trusting denials are legitimate breaches) is a goal that 
is not necessarily here yet... while there are still bugs being filed in policy 
you (or 'average users' such as me and most rawhide testers) have very little 
chance of knowing which is which.

That doesn't mean it is not working... a security problem thats generating 
denials is only a problem per se when you go and disable selinux thinking 'its 
just a bug I can ignore these and let it happen'.

As long as a bug is filed, and your machine is still enforcing, and someone 
hasn't found a way around the denials, either the policy will change or Dan is 
going to post back to that bug report that what is happening is definitely not 
going to be allowed by policy.  Thats when you go fishing for your security issue.

Most people probably just go and disable it, assuming denials were from 
something they were trying to do and a bug prevented them from doing it.  I 
think its very important that rawhide testers be using selinux though because 
there is no way to prevent policy bugs from getting to release (and the broad 
userbase from then disabling selinux...) otherwise.

-- 
Andrew Farris <lordmorgul at gmail.com> <ajfarris at gmail.com>
  gpg 0xC99B1DF3 fingerprint CDEC 6FAD BA27 40DF 707E A2E0 F0F6 E622 C99B 1DF3
No one now has, and no one will ever again get, the big picture. - Daniel Geer
----                                                                       ----