Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

One of the first things that sysadmins at my last place of work would do is turn off SELinux on new installs of RHEL.

There were too many times that SELinux would cause issues for them because they didn't understand the built-in policies and where to place stuff. As a security conscious person, it is a HUGE pain in the behind and I've spent many hours debugging SELinux and it's policies.



That is unfortunately a bad practice but there also people out there who leave it in enforcing mode and actually make an effort to use it.

I think selinux use has increased lately, at least from my perspective.

Where I work I am constantly forcing it on people and volunteer to solve any problems they might have to ease their transition.

Just like pledge would require passionate developers who actually care about implementing pledge on the application level, SElinux requires passionate sysadmins who actually care about using it, and about their co-workers using it.


On the other hand, SELinux protected me against the "venom" VM escape vulnerability earlier this year. That was nice :)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: