SElinux

[Jim Cornette]

Rahul Sundaram wrote:
> On Sun, 2006-04-02 at 13:20 -0500, Les Mikesell wrote:
>> On Sun, 2006-04-02 at 10:04, Craig White wrote:
>>
>>> As for SELinux making a system 'unstable' - I can't envision a scenario
>>> that SELinux would do that. 
>> Frequency of updates is a good metric for stability.  How many
>> SELinux updates have been issued since it was experimentally
>> included in fedora?
> 
> FC2 had strict policy disabled by default. FC3 targeted policy had a
> dozen or so daemons. FC4 had 91. FC5 has a whole new reference policy
> and other changes and there has been a steady inflow of policy updates
> in every release. 
> 
> http://fedoraproject.org/wiki/SELinux/FC5Features
> 
> Rahul
> 


I noticed the idea of getting a GUI tool for SELinux was hinted strongly 
on the page.

Comments regarding the thread. I don't think that making SELinux 
difficult is the goal of any program. Having a GUI management tool to 
utilize semanage would be an ideal tool and would lessen the tendency 
for a slew of users as well as developers from disabling SELinux.

Regarding the need for every computer user to dedicate a lot of time to 
learning low level aspects of SELinux should not be needed. Using a 
high-level approach to manage SELinux is a better approach to take to 
make its usage widely accepted.

Regarding needing to be a very knowledgeable user regarding admin issues 
is not really why one wants computers for. As noted by earlier postings, 
businesses want to be able to keep their systems up where they can deal 
wth business tasks. They need a secure system, just not a system where 
the management is cryptic.

Admin issues in general, keep it easy to manage. I even use 
system-config-boot. Having a system-config-SEmanager would greatly 
simplify managing one's computer, especially with the reality that there 
are many external repositories to choose from and putting the burden on 
a developer to need to tailor policy or inform the user that it is not a 
core program so policy additions would not be added to the policy. Yumex 
comes to mind.

Thanks!
Jim

-- 
50% of the manual is in .pdf readme files