Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

SELinux enhanced local security by improving the isolation between processes and providing more fine-grained security policies.

For multi-user machines, this can be useful because of the more flexible policies, and it raises more barriers between users so it adds protection against malicious local users.

For servers, SELinux can reduce the impact of a security vulnerability in a server. Where the attacker might be able to gain local user or root privileges, SELinux might only allow him to disable one particular service.

For typical home use, where you'll be the only user and you'll want to be able to everything remotely once authenticated, you won't gain any security from SELinux.


The problem with SELinux for non-IT people like myself is that it does not identify itself as the cause of permissions problems - in other words the errors you get are not distinguishable from other more common errors and SELinux is the last place you will look or for which you will be able to get answers publicly. This is the worst type of feature IMO.

http://jermdemo.blogspot.com/2011/10/selinux-for-enhanced-headaches.html