Messages in this thread | | | Date | Tue, 9 Mar 2010 08:29:38 +0100 | From | Ingo Molnar <> | Subject | Re: Upstream first policy |
| |
* Linus Torvalds <torvalds@linux-foundation.org> wrote:
> On Mon, 8 Mar 2010, Alan Cox wrote: > > > > man restorecond > > I know. I also sometimes sit through minutes of "let's relabel the system, > because you've booted a kernel without selinux support".
I've had selinux relabeling wait times of an hour or two too, on a sufficiently large filesystem.
I think this hurts security far more than anything else, because it causes people to actually _turn off the whole thing_ - so we will have less and less security in the end.
( To use the obligatory fire door analogy: we should prefer a one inch thick fire door that opens and closes fully automated to a five inches thick fire door that people keep always-open with a chair. )
Ingo
| |