[CentOS] SELinux and access across 'similar types'

Wed Jan 11 21:23:13 UTC 2012
Lamar Owen <lowen at pari.edu>

On Wednesday, January 11, 2012 11:42:08 AM Les Mikesell wrote:
> On Wed, Jan 11, 2012 at 9:15 AM, Lamar Owen <lowen at pari.edu> wrote:
> > On Tuesday, January 10, 2012 04:38:27 PM Les Mikesell wrote:
> >> But the hardest part is that these things are application specific and
> >> there is no standardization for locations where applications do
> >> things.  In fact, distributions intentionally move those locations
> >> around in their packaging.

> > Distribution differences are the price we pay for choice. 

> If the first thing you saw on a unix-like system was the horror of
> autoconf, would you have taken a second look?  

The first thing I saw on a unix-like system was hand-edited Makefiles; I got into this thing before autoconf came into being, a 68k at 10MHz was fast, and 768K of RAM was enough to work with the eight-inch 1.2MB floppies and 5.25 inch full-height 12MB hard drives of the day.  Having owned three different unix-like systems of that era, I'm well aware of the difficulties; and all were 680x0 systems, but all different.

> This is an even worse
> situation, because there is no equivalent way to describe what you
> want across flavors.  

Yes, there is, actually.  SELinux policies.

> How is the application developer
> (unquestionably the expert on the application needs) supposed to
> describe those needs to SELinux in a way that can work across
> distributions without 'less-expert' people guessing about them?

This is a problem that each upstream project will need to work out for themselves.

> I guess you are right about the state of the art and that it is as
> wrong to expect things to work as it was to expect flying cars by now.

I wish I were wrong, honestly, but it is the current state of the art.

>  But it would have been fun.

No doubt; I'm waiting on my George Jetson air-scooter-in-a-briefcase myself.