On Fri, 2008-04-04 at 12:14 +0200, Harald Hoyer wrote: > Harald Hoyer wrote: > > Turning off selinux and related services saves 10s overall boot time. > > Trading off security with boot time. I don't know. But maybe a good > > starting point for optimization. > > Boot time: > 35s without selinux and without auditd > 40s with selinux + auditd + restorecond > 45s with selinux + auditd + restorecond + setroubleshootd > > I can live without setroubleshootd.. auditd and restorecond are also optional for selinux. mcstransd should be optional as well for selinux. None of them existed originally for selinux; they are all later add-ons. In the absence of auditd, SELinux avc messages just go to /var/log/messages instead. In the absence of restorecond, you might find certain files will be left mislabeled when re-created, although usually that gets covered automatically by policy. But you can always restorecon them by hand as needed. In the absence of mcstransd, the MCS/MLS label component (:s0) will be visible and you won't have mapping support for translating categories to more meaningful names. But you don't really need it if not using categories for anything. -- Stephen Smalley National Security Agency -- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
