On Saturday 07 January 2012 05:39:15 Bennett Haselton wrote:
> On 1/7/2012 5:25 AM, John R. Dennison wrote:
> > On Sat, Jan 07, 2012 at 04:43:31AM -0800, Bennett Haselton wrote:
> >> Virtually every hosting company I've ever bought a CentOS server from
> >> has had SELinux turned off by default. (So, a partial list would
> >> include FDCServers, Superb.net, SiteGenie, SecuredServers (ho, ho),
> >> AeroVPS (sells dedicated servers despite their name), Netelligent,
> >> ServerBeach and I don't remember all the others). Don't hold me to
> >> that
> >> list 100% since some might have changed their policies for new servers
> >> but it's pretty universal.
> >
> > Then these companies should be universally boycotted as it's pretty
> > evident that they don't place security at the top of the importance
> > stack.
> >
> > People that don't run selinux deserve _everything_ they get and then
> > some.
>
[snip]
> Apparently the marketplace favors hosting companies turning SELinux off
> because the failures it causes are too obscure and it causes too many
> support headaches.
Ignorance is bliss... ;-)
A hosting company should certainly have SELinux turned on by default. A
customer who doesn't know how to handle it should be told to RTFM. If they
don't want to deal with SELinux, they can easily turn it off themselves (at
their own responsibility).
This is analogous to having a rent-a-car agency renting cars without safety
belts, because "they are inconvenient for the users and most people don't put
them on anyway". Being irresponsible cannot be justified with what marketplace
does or does not favor.
> A non-changing-human-nature solution might be to
> notify the user directly when SELinux blocks something. The GUI
> apparently already does this via a dialog box when viewing a desktop;
> perhaps there's a way to do it on the command line too. (When the user
> runs something that's blocked by SELinux, just send a message to the
> terminal saying "SELinux blocked this", or something. Would be a start.)
Sometimes there is a message on stderr about "permission denied" or such. But
in general every AVC denial is written in /var/log/audit/audit.log. There are
also setroubleshootd and sealert, to help you "translate" the AVC denial into
something more user-friendly, and suggest what to do about it.
HTH, :-)
Marko
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
