I've finally turned SELinux fully off even on my laptop
As I've mentioned before, I started out with
SELinux turned on on my laptop because it's essentially a stock
Fedora install and that's how Fedora defaults, and using SELinux
felt virtuous. Last year I reached the end
of my patience with running SELinux in enforcing
mode, where it
actually denies access to things; instead I switched it to permissive
,
where it just whines about things that it would have forbidden and
then a whole complicated pile of software springs into action to
tell you about these audit failures with notifications, popup dialogs
and so on.
Today I gave up on that. My laptop
now has SELinux disabled entirely (as my desktop machines have for
years). The cause is simple: too many SELinux violations kept
happening and especially too many new and different ones kept coming
up. I am only willing to play whack a mole on notification alerts for
so long before I stop caring entirely, and I reached that point today.
The simplest and most easily reversed way to stop getting notifications
about SELinux violations is to set the SELinux policy to disabled
in
/etc/selinux/config
, so that's what I did.
It's possible that some of the problem is due to just upgrading to
Fedora 22 with yum
instead of, say, fedup
, and perhaps it could
be patched up somewhat with 'restorecon -R /
'. Perhaps a wholesale
reinstall would reduce it even more (at the cost of putting me
through a wholesale reinstall and then figuring out how to set up
my environment and my account and keys
and wifi access and VPNs and so on all over again). Certainly I
assume that SELinux has to work for some people on Fedora. But I
no longer care. I am done with being quixotically virtuous and
suffering for it.
(I originally put a rant about Fedora and SELinux here, but after
thinking about it I took it out again. It's nothing I haven't said
before and I can't be sure that my SELinux
problems would still be there if I did absolutely everything the
officially approved Fedora way. Since I'm never going to stop eg
doing Fedora version updates with yum
, well, that case will never
apply to me.)
|
|