[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Proposal: Improving SELinux <--> user interaction on Fedora - Kerneloops for SELinux



On Thu, Jul 17, 2008 at 6:00 PM, Dave Airlie <airlied redhat com> wrote:
> Even so, don't let the user know, clearly they won't do the right thing,
> and you end up training them with the wrong behaviour. stop thinking of
> the user being someone who knows or cares what a policy/selinux or an
> exemption is.

While I agree with your statement as is, it is my unverified suspicion
that 'fedora user' is significantly different from 'user'.

Thankfully, Fedora is not Ubuntu, and I may be idealistic, but I think
we may be able to expect a bit more from the average Fedora user...

which leads me to another idea. Would probably be great if we could
have all AVCs copied easily to a central machine for those who use
Fedora in enterprise type environments.

Example:

- Emplyee A does something acceptable, encounters and AVC
- AVC reported to sysadmin
- Auto fix attempts fail
- request denied
- sysadmin reviews, decided to allow all such AVCs

then

- Emplyee A does same acceptable thing, encounters and AVC
- AVC reported to sysadmin
- activity found whitelisted
- auto fix tool allows

But that may be overkill.

-- 
Fedora 7 : sipping some of that moonshine
( www.pembo13.com )


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]