> If selinux helps you, then use it. If it doesn't, then don't. No one is twisting your arm and forcing you at gunpoint to use it.... yet. The beauty of open source is that it's all about choice. Do what you want, so long as you're smart enough to do it. Since SElinux seems to spawned as an intern type project and nothing more, what I object to is it being enabled by default. -- when really it should be an option to enable it, which a warning that it wasn't tested for vulnerabilities, does not add any official security value to Linux and will of course slow the system down. Furthermore it adds a layer of security obfuscation which will in itself lead to administrators making mistakes and inadvertently lowering security as it is such a PITA. Unices were configurable to be secure by many a competant administrator before this addition of bloat to the OS. I choose not to use it, but ocassionally on some of my RHEL installs I forget to turn it off, if it is off by default I wouldn't need to keep removing it! What I find most curious is, despite the authors of it claiming nothing of any note about it in terms of security, and in fact in the link I originally posted the authors go quite some way to distance themselves from claiming it adds any actual security, and hasn't been tested for vulnerabilities as such, that some people still swear by it as the gospel truth and the only one true path. Whilst such religious commitment to an unproven cause undoubtedly shows good faith, I would add that such blind practices are best left to sunday school or the church sermon. P. rado wrote: On Mon, 2006-09-18 at 20:32 -0400, Jim Perrin wrote: -- This message has been scanned for viruses and dangerous content by the Enhancion system scanner, and is believed to be clean. |
_______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
