Maybe so... and if it works for you then use it, but sometimes when people say  "but we needed this or we needed that",  they haven't allways sat down and thought "why do we need it" or "do we really 'need' this ?"

Even having worked on government classified networks I have *never* seen an instance where the standard access controls offered by Linux/Unix didn't do what was required.

Often DAC/MAC setups leads to inferior security because they can get very complex to setup, and the term "can't see the wood for the trees" springs to mind.

As is most often the case the best security is the simplest, and DAC/MAC bloat doesn't help in any way.

If some document or requirement or spec says you need it, I would often question the theory behind the spec, and only if a demonstrable need arises (have yet to see that in 20+ years of consulting) then I would do it...

Of course I've also been in this game too long as well to "never say never" and there is always a first time....  :-)

P.




Bryan J. Smith wrote:
On Tue, 2005-05-24 at 08:24 +0100, Peter Farrow wrote:
  
Just turn off SELinux, it really is a complete pain.
I've managed to set up Linux and Unix boxes securely for years without 
all the SE Linux baggage.....
All it does is slow the machine down, and adds "bloat" to the OS...
    

Unfortunately, Mandatory Access Controls (MACs) are a necessary
accountability detail needed in many environments.

It's really the only place NT was better than legacy UNIX.

Of course, I would return argue that Linux at least addresses all
aspects of the 7 domains of the SSCP _except_ the MAC portion of
DAC/MAC, whereas Microsoft only addresses 3 of them in the OS as
standard.

But we needed MAC.  It's a good thing to have in many environments --
especially where accountability is essential.