Thomas Vander Stichele wrote:
Hi,
- A lot of developers I know, including a bunch at Red Hat, *turn offFWIW I have three machines here, of which two have SELinux always on in
SELINUX entirely*. IMO, something that gets pushed at heavily as this
should be dogfooded by the development team at Red Hat completely, so
they encounter firsthand what it means and how to fix basic issues.
enforcing mode, and the third sometimes on (dogfooding Rawhide here, so
sometimes things break...). They're all using the targeted policy.
Oh, I'm sure there are developers dogfooding it. My point is that *all*
of the Red Hat developers should be dogfooding it if you think SELINUX
should be the default (which I assume is being thought since it's the
default in anaconda).
Why *all* so vehemently? There are devel issues other than selinux that occaisionally
crop up, and there is still a need to develop software that is (not yet anyways ;-) infected
with selinux.
FWIW, I've been dogfooding SE Linux for over a year without serious discomfort.
Sure there have been surprises. E.g. certain problems caused fsck to spew messages
that I dinna not even existed. On the whole, "targeted" selinux is pretty close to drop in
these days imho.
OTOH, I fully understand your out-of-box introduction to selinux trying to run mach.
That is a very hard environment, and there has been no serious attempt yet (afaik)
to attempt to write policy for a build system. That too is a rather hard problem requiring
different policy decisions than what is in "targeted".
Perhaps *you* should have started dog-fooding selinux sooner. It's not exactly like
the SELinux clouds have not been gathering for quite some time.
73 de Jeff
