21:02 Friday, December 12 2006

SELinux sucks

I spend over an hour today helping a developer at work debug a bizarre problem after he upgraded from FC2 to FC6 (I have no idea why he waited 4 versions before upgrading). He was running a samba server on his FC box, and trying to access the shares from some windows boxes, and he could browse everything but /home. He was using the same smb.conf as in FC2, and the error in the samba log was basically just a 'permission denied' any time he tried to get into /home (which was really the only place he wanted to get anyway). After trying all kinds of sane steps, it occurred to me that SELinux had been turned on by default since FC2. I had him disable SELinux, and bingo, problem was gone. SELinux might actually be useful if you're running an internet facing production server where you don't trust anyone accessing the box, but for just about everyone else, its the most retarded security overkill imaginable, and consistently causes more pain & suffering that it could ever help to avoid.