[CentOS] [OT][Practices] The Case for RBAC/MAC

Fri Nov 18 14:04:34 UTC 2005
Craig White <craigwhite at azapple.com>

On Fri, 2005-11-18 at 05:43 -0800, Brian T. Brunner wrote:
> 1: e-mail is a people skill, you affect people with it.  The value
>     of your presentation rises or falls with your skill at presentation.
> 2: My embedded headless linux targets live in isolated 
>     networks, even relative to other computer or 
>     network equipment at the target site.  At times, the nearest
>     land is 2 miles straight down (ocean floor).
> 3: These targets are also without anything resembling 
>     a linux-aware operator and (ipso facto) must generate 
>     NO mail and self-limiting logs of a "usually ignored' type.
> 
> from the above, SELinux offers me *nothing* I need and costs me
> something for which there is no reward.
> 
----
I would bet a dollar that there is a CentOS server in your office where 

grep 'SELinux=disabled' /etc/selinux/config == true

that notwithstanding, I am sure you realize that considering your
premise of usage stated above, that a strong argument could be made that
it is an ideal candidate for the protections of SELinux.

Of course, you are the master of your systems and you are in control
over the decision on what to employ and then who is to say that you are
wrong in your assessment.

As for email skills, there are likely a lot of readers of this list that
see the people who frequently post and probably put a lot of trust in
their opinions and someone who unwittingly has this position and says -
just disable it - probably does a disservice to those who might only be
looking for justification to turn off something that they don't
understand. Email skills can also encompass the ability to recognize the
difference between expressing an opinion for one's own peculiar usage as
it relates to the broader base as a whole and make the distinction
clear.

Craig


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.