I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier it felt like when I discovered SELinux which I had not priorly heard of. After doing some research it seemed as though most people were of the opinion that you should just disable it and not deal with the hassle. Personally if it really does add more security I'm not opposed to dealing with the headaches of learning how to appropriately set it up. Eventually I plan on opening my network up so that this pc can be access remotely but I don't want to do that until such time as I'm confident that its secure (more or less... lol). If you have set it up and gotten it functioning correctly do you feel that it was worth the time and hassle? Is it really more secure? If you have opted out of using it was that decision founded on any research worth considering in my situation as well?
SELinux enhanced local security by improving the isolation between processes and providing more fine-grained security policies.
For multi-user machines, this can be useful because of the more flexible policies, and it raises more barriers between users so it adds protection against malicious local users.
For servers, SELinux can reduce the impact of a security vulnerability in a server. Where the attacker might be able to gain local user or root privileges, SELinux might only allow him to disable one particular service.
For typical home use, where you'll be the only user and you'll want to be able to everything remotely once authenticated, you won't gain any security from SELinux.
|show 1 more comment|
The problem with SELinux for non-IT people like myself is that it does not identify itself as the cause of permissions problems - in other words the errors you get are not distinguishable from other more common errors and SELinux is the last place you will look or for which you will be able to get answers publicly. This is the worst type of feature IMO.