FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora Development

 
 
LinkBack Thread Tools
 
Old 07-02-2008, 11:01 PM
Matthias Clasen
 
Default Request to re-add option to disable SELinux

On Wed, 2008-07-02 at 16:33 -0400, seth vidal wrote:
> On Wed, 2008-07-02 at 16:29 -0400, Matthias Clasen wrote:
> > On Wed, 2008-07-02 at 16:10 -0400, Jon Masters wrote:
> >
> > >
> > > *). Tools like nautilus do not support labeling of files via the
> > > right-click properties dialog (gnome VFS, etc.) so there is no easy way
> > > for an end user who even understands part of this to fix context. This
> > > is the number one reason why SELinux should not be enabled by default,
> > > except on systems where there is an admin who can use chcon.
> >
> > I don't disagree with the general sentiment that selinux is not a very
> > good fit for desktop users as it is today. But nautilus _does_ support
> > labeling of files via the right-click properties dialog.
> >
>
> Where? I see it showing me what they are but I don't see how to change
> them.
>
> is it an option I have to enable?

Ah, I think the fix for that narrowly missed F9.
I have it working on rawhide here.

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list
 
Old 07-03-2008, 01:29 AM
James Morris
 
Default Request to re-add option to disable SELinux

On Wed, 2 Jul 2008, Alan Cox wrote:

> Knowing what it is isn't sufficient - they must know enough to make a meaningful
> risk analysis fo the decision. Very few users I suspect are in that position.

This is quite a significant problem, as people tend to underestimate
negative risk and overestimate positive risk (according to "Prospect
Theory").

And as the odds increase in each direction, people increasingly mis-judge
them. e.g. people believe they'll win the lottery but figure they don't
need a motorcycle helmet.

Bruce Schneier recently discussed the topic:
http://www.schneier.com/blog/archives/2008/05/how_to_sell_sec.html

The only way to really make progress in improving security is to make it a
standard part of the computing landscape; for it to be ubiquitous and
generalized, which is the aim of the SELinux project.

Having a separate "secure" version or option will not work, as proven many
times over with the trusted Unix variants which are essentially forks of
their respective mainline products.

Avoiding the whole issue will also not work, as DAC security simply cannot
provide adequate protection in a globally networked environment. The
rationale for MAC has been made very clear in an NSA paper, the reading of
which I think is essential for any informed discussion on the issue:

http://www.nsa.gov/selinux/papers/inevitability/

Punting the decision to the end user during installation is possibly the
worst option. It's our responsibility as the developers of the OS to both
get security right and make it usable. It's difficult, indeed, but not
impossible.



- James
--
James Morris
<jmorris@namei.org>

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list
 
Old 07-03-2008, 01:29 AM
Andrew Farris
 
Default Request to re-add option to disable SELinux

Jon Masters wrote:

On Wed, 2008-07-02 at 17:16 -0400, Alan Cox wrote:

SELinux should be disablable is the wrong discussion. The discussion you should
be having is "I've filed a few bugs where SELinux didn't magically do the right
thing, how do we fix them and can we make these less likely to occur in future"


I think the only way to "fix" it for the foreseeable future is to
simplify policy, so that only a very limited set of services are
confined. Then, when the graphical tools and user experience have
eventually caught up, it'll be trivial to switch policy again.


selinux-policy-targeted is precisely that.

--
Andrew Farris <lordmorgul@gmail.com> www.lordmorgul.net
gpg 0x8300BF29 fingerprint 071D FFE0 4CBC 13FC 7DEB 5BD5 5F89 8E1B 8300 BF29

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list
 
Old 07-03-2008, 01:34 AM
Jon Masters
 
Default Request to re-add option to disable SELinux

On Wed, 2008-07-02 at 18:29 -0700, Andrew Farris wrote:
> Jon Masters wrote:
> > On Wed, 2008-07-02 at 17:16 -0400, Alan Cox wrote:
> >> SELinux should be disablable is the wrong discussion. The discussion you should
> >> be having is "I've filed a few bugs where SELinux didn't magically do the right
> >> thing, how do we fix them and can we make these less likely to occur in future"
> >
> > I think the only way to "fix" it for the foreseeable future is to
> > simplify policy, so that only a very limited set of services are
> > confined. Then, when the graphical tools and user experience have
> > eventually caught up, it'll be trivial to switch policy again.
>
> selinux-policy-targeted is precisely that.

Or more precisely, it would like to be that. Abrupt, single line replies
like the above amuse me perhaps more than they should, because they
carry the implication that I didn't actually consider what is currently
implemented in Fedora before sending my original mail

Anyway. I've tried to make my point, I'm done now

Jon.


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list
 

Thread Tools




All times are GMT. The time now is 12:07 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org