Ian Malone: >>> The 'correct' solution seems to be to use chcon -t texrel_shlib_t on >>> every file that has this problem (use dmesg to hunt them down). Tim: > > I'm not sure I'd do that on "every" file that generates that warning. > > Some of them probably shouldn't be allowed to do that, that's why > > there's a restriction for that sort of thing. Ian Malone: > I'm sure you're right, but I have no idea even what I'm allowing > them to do, and very little incentive to invest the time in SELinux > to find out how to make the decision. (And I'm sure that path > ends up with me trying to security audit every package on my > home machine which would be craziness.) If you don't have time to get it right, you might as well not use it. Having SELinux on, but allowing everything, isn't doing you any good. It can even cause you problems: Permissive mode isn't completely permissive, it's been found. And some people find SELinux slows their systems down. If you want to get it right, but aren't sure about how to do it, I can see two simple options: Write to the list with specific problem examples. or bugzilla the package, and get the maintainer to fix up their package (might be the particular package, or the SELinux policies). I haven't really found SELinux to be a problem, I haven't had to go fixing up things here, there, and everywhere. -- (Currently testing FC5, but still running FC4, if that's important.) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists. -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
