you are viewing a single comment's thread
view the rest of the comments
[–] 41 points 1 week ago (8 children)

selinux relies on the basis of deny all, allow only ideas. On paper that's fine, but when you are troubleshooting issues, installing software or developing applications, it can hinder productivity by preventing the user from doing things.

Selinux CAN work, but it absolutely requires a lot of time investment and maintenance to keep it working well with audit.d and general logging.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 11 points 1 week ago* (1 child)

    selinux relies on the basis of deny all, allow only ideas

    Only in enforced.

    but when you are troubleshooting issues, ,

    Just set setenforce 0 for this

    installing software or developing applications

    for this see policy log and create selinux policy with generator if developer was lazy

    it can hinder productivity by preventing the user from doing things

    Highter productivicy before someone still all your code (like binance)

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 week ago* (last edited 1 week ago)

    I wish I could set up SELinux but NixOS doesn't support it... I already do something similar where all files on root are wiped by default (E: on each boot) and I have to opt things into persistence so it's definitely something that I'd like.

  • source
  • parent