On Tuesday, August 31, 2010 21:18:16 Erik P. Olsen wrote: > On 31/08/10 11:22, Alan Cox wrote: > > Do you understand the details of how your airbag system works, or how > > your ABS braking works. Can you model the crumple zones of a car, or do > > you just get in and put up with the little safety inconveniences like the > > weight of the doors, the length fo the vehicle, the seatbelts ? > > Why do people always pick examples of features with easy user interface > when the fact with selinux is that the user interface is totally > incomprehensible for the ordinary home user. I for one disable selinux > because I don't want to waste time with learning how to use it. The user interface of SELinux is the most trivial one possible --- it is supposed to Just Work, completely transparently. An ordinary user should never get into a situation to ever interact with SELinux policy. If you do get an AVC denial and a warning in the system tray, something is *wrong* with the machine. Either you are trying to do something you shouldn't, or someone else is. In both cases you are better off investigating what went wrong and correcting the cause of the denial, rather than modifying the policy to allow the rouge access. The analogy with ABS would be you trying to tinker with the wheel lock-up detection system in order to tweak it to work differently (and probably less safe then the factory default). The user interface for that simply doesn't exist on an ABS system, and you need detailed technical knowledge on how to tinker with it. And as a regular user you should never do that. SELinux is the same --- in normal usage you simply don't interact with it. That is the easiest "user interface" imaginable. If you want to tinker with it, you need detailed technical knowledge on how to do it. The issue here is that a lot of people are used to the *wrong* idea that SELinux is the one needing adjustment when something goes wrong. Today this is rarely the case (was more frequent in the past, but not anymore), and you should file a bugzilla if it happens. What typically needs adjustment is the cause of the AVC denial, ie. the program that caused the denial, or the user who is manipulating the program and files in a wrong way. How many times did you get into a situation to execute some command, only to be responded with a "permission denied, you are not root" kind of message? When that happens, who is at fault? Do you go change the permissions of relevant files to allow access to yourself, or do you understand that you are trying to do something in the wrong way, and adjust your own behavior? Some people like logging in as root and having root privileges all the time, because of the illusion that it is easier. But aside from some special cases, that is very well known to be a Bad Idea. Ditto for disabling SELinux. And in regular use, you just shouldn't need to adjust SELinux policy, and therefore should not need any user interface for it. Anything else is a bug, and nowdays typically not in the policy but somewhere else. Best, :-) Marko -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
