Johnny Hughes wrote: >On Mon, 2005-11-21 at 14:41 +0000, Peter Farrow wrote: > > >>Please go and look up "default" on the dictionary.... >> >> >> >It isn't the word default that I have a problem with ... it is enabled. > >Nothing is enabled until you click past it without taking action. > >You "Enable" the things that you want. > >Now ... I would agree that the "Default" selection is having SELinux in >"Permissive Mode" ... and that user action and knowledge is required >when deciding what they want to do concerning SELinux. > > > If you are doing a Server Install, on 4.2, "Enabled" is highlighted (by default ;) ). One has to select permissive (warn only) or off to keep it from being enabled (unless warn and permissive are different?). Just did this Saturday. It does seem that it was not this way during some other install process, way back in some other time... long, long ago (as if this has been around that long). It was about that same time that I started figuring out suexec. That made some radical changes to many of our user's setups (yes, one could argue they 'needed to be fixed'). Doing an install is a bit of an arduous task. I haven't liked the direction RedHat has taken in recent years and actually preferred the select each package method from back in the 7.2 days. It seems that the 'list' shown now is nowhere near complete. But, I'll trade these issues for the RPM system and the great updating proceedures. Things like selinux do get in the way... another stall to go figure out. And with something as raw as selinux, I'm not all that happy that it is the default selected item on the way in. The attitude of if you don't know, Redhat knows best just doesn't seem to fit here. Anyway, I guess this all is a mute point. CentOS is supposed to 'follow the upstream provider as closely as possible' right down to Anaconda.... This 'default' thread really belongs on 'de fault' Redhat list. Then again, most of us can't complain there because we don't pay them anything. I am however glad that the selinux issues have been posted, as it helped me decide that my stuff isn't ready for it. I have been enabling it under warn mode, just so I can see/learn what issues it feels are potential security holes. Best, John Hinton