Messages in this thread | | | Date | Tue, 9 Mar 2010 18:46:33 +1000 | Subject | Re: Upstream first policy | From | Dave Airlie <> |
| |
On Tue, Mar 9, 2010 at 5:29 PM, Ingo Molnar <mingo@elte.hu> wrote: > > * Linus Torvalds <torvalds@linux-foundation.org> wrote: > >> On Mon, 8 Mar 2010, Alan Cox wrote: >> > >> > man restorecond >> >> I know. I also sometimes sit through minutes of "let's relabel the system, >> because you've booted a kernel without selinux support". > > I've had selinux relabeling wait times of an hour or two too, on a > sufficiently large filesystem. > > I think this hurts security far more than anything else, because it causes > people to actually _turn off the whole thing_ - so we will have less and less > security in the end. > > ( To use the obligatory fire door analogy: we should prefer a one inch thick > fire door that opens and closes fully automated to a five inches thick fire > door that people keep always-open with a chair. )
selinux relabels are the new fsck.
maybe we need selinux3 or chunk-selinux.
Dave. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |