Linked by Thom Holwerda on Tue 6th Mar 2007 15:56 UTC, submitted by Rob Phillips
Thread beginning with comment 219258
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Agreed. I think SElinux is a very important step in the right direction, but a) so far I haven't been entirely happy with it, and b) there are a few contenders out there. Hopefully it will continue to mature into something truly usable, much like ipchains did (iptables is very functional, if slightly anti-human in its syntax).
Personally, I've been playing with GRSec on a few testing boxen, and so far like it quite a bit - and yes, I understand that GRSec vs. SElinux is apples and oranges...





Member since:
2005-07-24
I'm not a big fan of Selinux for most common purposes. Unnecessary complexity is not the friend of good security, and Selinux has complexity in abundance.
Just look at how long it took the smart folks developing Fedora to get the policies right. Arguably, they *still* don't have them quite right.
Of course, for those specialized cases where such fine grained complexity is really needed, it may be a great fit.
But Selinux reminds me of a half joking remark I read about sendmail.cf somewhere a long time ago:
"Most people get their sendmail.cf from God (their distro)... and pray that it just works."
Edited 2007-03-07 15:21