I've finally turned SELinux fully off even on my laptop
As I've mentioned before, I started out with
SELinux turned on on my laptop because it's essentially a stock
Fedora install and that's how Fedora defaults, and using SELinux
felt virtuous. Last year I reached the end
of my patience with running SELinux in enforcing mode, where it
actually denies access to things; instead I switched it to permissive,
where it just whines about things that it would have forbidden and
then a whole complicated pile of software springs into action to
tell you about these audit failures with notifications, popup dialogs
and so on.
Today I gave up on that. My laptop
now has SELinux disabled entirely (as my desktop machines have for
years). The cause is simple: too many SELinux violations kept
happening and especially too many new and different ones kept coming
up. I am only willing to play whack a mole on notification alerts for
so long before I stop caring entirely, and I reached that point today.
The simplest and most easily reversed way to stop getting notifications
about SELinux violations is to set the SELinux policy to disabled in
/etc/selinux/config, so that's what I did.
It's possible that some of the problem is due to just upgrading to
Fedora 22 with yum instead of, say, fedup, and perhaps it could
be patched up somewhat with 'restorecon -R /'. Perhaps a wholesale
reinstall would reduce it even more (at the cost of putting me
through a wholesale reinstall and then figuring out how to set up
my environment and my account and keys
and wifi access and VPNs and so on all over again). Certainly I
assume that SELinux has to work for some people on Fedora. But I
no longer care. I am done with being quixotically virtuous and
suffering for it.
(I originally put a rant about Fedora and SELinux here, but after
thinking about it I took it out again. It's nothing I haven't said
before and I can't be sure that my SELinux
problems would still be there if I did absolutely everything the
officially approved Fedora way. Since I'm never going to stop eg
doing Fedora version updates with yum, well, that case will never
apply to me.)
Comments on this page:
|
|