Is now a good time to convert to selinux?

[0n0w1c]

I have been running on gentoo for about two years so I am fairly comfortable with it. I am getting an itchy trigger finger to try selinux.. I am using great restraint from just doing it now and asking questions later...

The line in the hardened docs about the workstation not being supported has stopped me.
Even redhat installs selinux by default these days... so why so much caution with gentoo?

Am I really asking for trouble if I convert?

emerge info:

[Master Shake]

You know I kinda want to do some selinux stuff too. But I'm thinking that its going to be easier to reinstall the entire system from scratch with selinux support. I know my brother tried to install selinux on a computer that was running slackware. He did it, but after awhile he was just too pissed off at the thing.
_________________
System Specs:
64-bit gentoo linux
Q6600 @ 3.2Ghz
P35 Chipset
4 Gigs 800mhz 4-4-4-12
Nvidia GeForce 8800 GTX @ 630mhz

[nixnut]

Redhat/fedora are not running a full selinux system by default. They are using what they call the targeted policy by default (there is also strict policy). That means that only the applications for which the have created policies run restricted by selinux, all other applications run unrestricted. The available policies cover mainly the basic system and server applications. Desktop applications mostly run unrestricted.
Gentoo does not have a targeted policy, so everything runs restricted by selinux if you enable enforcing mode. Unfortunately Gentoo does not have much policies for desktop applications at the moment, though people are working on it.
_________________
Please add [solved] to the initial post's subject line if you feel your problem is resolved. Help answer the unanswered

talk is cheap. supply exceeds demand

[0n0w1c]

Well, I made the leap!
So after, rather than before, I ask... can I get back? If so... is there a howto?

Just asking... so far so good.

[0n0w1c]

While I am asking and seemingly determined to b0rk my system... how about PAX?

For those that may be wondering... the road via conversion to selinux was not without a few issues, your mileage may vary.
Splashutils can not be compiled with a hardened gcc (no issue for me, I just unmerged it).

Most every large package needed to be re-emerged because of the selinux, hardened or ldap use flags.

The biggest issue is that ufed keeps adding the "-selinux" flag... is my config missing something?

gdm has an issue with logging in as a normal user, "Unable to set executable context" in permissive mode. I have not looked into this yet, I simply re-emerged it with "-selinux" until I have time to figure it out.

I am holding off on re-emerging openoffice (hardened flag)... won't version 2 be available soon, even with ~x86?

[0n0w1c]

[kalisphoenix]

I dunno. I just started a clean install with SELinux and, when I emerged hardened-sources, I returned to find that SELinux decided to UNmerge everything on my system (including portage and every other useful prog). I'm going to give it another try, but I'm not sure I'm digging this...

[Cinquero]

It would be quite nice to have some sort of user module for SELinux, ie. something that allows me to run SELinux unconstrained but force domain transitions for specific processes. It would be really great if such a thing could be integrated with KDE.

Typical use cases:

1.) Set up a rule that automatically forces a domain transition for every process which connects to a network socket.

2.) Limit access permissions for firefox, licq etc. to ~/.mozilla and /usr etc.

Modifying the SELinux rules interactively would be even better: start from a not-allowed-to-do-anything policy and then, when the app tries to do something, pop up a message window and decide to grant or deny that specific permission...

That would be even very useful to "write" policy files for all sorts of apps and daemons.

[Maedhros]

Moved from Installing Gentoo to Networking & Security.
_________________
No-one's more important than the earthworm.