On Wed, 2010-07-07 at 08:42 -0400, Paul W. Frields wrote:
On Wed, Jul 07, 2010 at 09:48:11AM +0300, Nicu Buculei wrote:
> On 07/07/2010 02:42 AM, Chris Jones wrote:
> > I hate selinux with a passion. And (also) running Ubuntu that has no
> > selinux is a joy for myself.
> > I am not saying that it doesn't serve its intended purpose, but is it
> > really necessary to be included in the Design Spin? I think not.
>
> Disabling SELinux on my desktop is one of the first things I do after a
> fresh install, *but* I pretty much know what I am doing there, I would
> *never* recommend that to a newbie or non-security conscious user (as
> the designers are presumed to be). So we must have SELinux installed and
> active by default.
I wanted to correct a misconception about the statistics for SELinux.
According to smolts.org[1], almost 70% of systems reporting to Smolt
have SELinux enabled, and most of these have SELinux in enforcing
mode.
I think these changes are due to both the excellent maintenance of
policy by Dan Walsh and others, and also more effective communication
about the benefits of SELinux.
I'd second that. I remember some years ago SELinux on desktop was
practically unusable -- lots of problems, applications stopping to work
because of it -- but now, I have SELinux turned on in enforcing mode and
everything works without issues. One thing that bugs me though, is that
the troubleshoot applet is slow like hell (and I still have some
wrongly-labeled directories from the olden times which I slowly relabel
anytime a SELinux denial pops up...) :-D
Martin