Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does SELinux make Redhat more secure?

I can't remember the number of times when I have disabled SELinux because it kept frustrating my ability to get stuff running. Lots of times to there was no obvious reason why stuff wasn't working and I had to Google to discover why.

Given that most casual users will disable or weaken security when it appears to get in the way, with the exclusion of serious, enterprisey Redhat users, is SELinux really useful?

PS. Is there some tool that helps you log, track and manage SELinux issues across all applications?

In spite of being an Ubuntu user I am a closet Fedora fan.

share|improve this question

4 Answers 4

up vote 4 down vote accepted

Yes, Selinux makes system more secure. But you'll need to undestand concepts of it and have at least basic knowledge about selinux and audit tools.

Selinux is logging to /var/log/audit/audit.log (but ensure auditd is running), and there are number of tools to solve selinux problems. Probably simplest way is to use is audit2allow

share|improve this answer
1  
/var/log/audit/audit.log, actually :) –  wzzrd Apr 7 '11 at 21:14
    
Thanks, you are right. –  rvs Apr 8 '11 at 6:53

Yes, SELinux makes Red Hat (and any other Linux distribution that actually uses it) more secure, assuming it's actually in use.

SELinux implements mandatory access control. Normal Unix permissions, ACLs, etc., implement discretionary access control. The two complement each other.

In order to work, SELinux requires a policy, defining what actions on the system may be allowed. While it's possible to create an entire system policy from scratch, most Linux distributions ship a policy based on the so-called reference policy. This means, among other things, that configuring SELinux across distributions will be very similar. (Most Linux distributions make the SELinux reference policy available in their package repositories, though it may not be installed by default.)

SELinux works by restricting users and processes to perform only the actions allowed to them in the policy. By default, the policy is to deny, so if the policy doesn't explicitly allow an action, then it doesn't happen. This is why you so often run into trouble with SELinux disallowing something you're trying to do.

On the bright side, this also prevents exploits, even 0-day exploits, from getting out of hand. For instance, if your web server (Apache) gets exploited, the damage is limited to only those things that Apache can access. It wouldn't be able to read your /etc/shadow file, for instance, even with a remote root exploit. While the Unix permissions (DAC) permit root to read the file, SELinux (MAC) does not permit the compromised process to step out of bounds.

The big gotcha is that there must be an SELinux policy module loaded for the service. If you install a service on your box which doesn't include an SELinux policy module, then it will run unconfined and be able to do whatever it wants. SELinux won't apply to it. The big one that falls into this category that you might be running today is nginx; while third party SELinux policy modules exist for it, I can't vouch for any particular one.

Another thing you should know is all about booleans. These tunable parameters are provided by SELinux policies to customize them for particular installations, and permit or deny access based on local configuration needs. For instance, you can give Apache access to Samba shares, enable Samba to share user home directories, and many other potentially useful things which are necessary for some setups but not others.

The best guide to SELinux that I've seen currently is Red Hat's Security-Enhanced Linux User Guide. It will help you get up and running quickly as well as fill in the background details of what's going on. It also includes a comprehensive troubleshooting guide that helps you get your process running under SELinux.

Is it useful?

SELinux protects against processes (and users, if you've confined your users) doing unexpected things. It severely limits the damage that a remote exploit can do. If you've never suffered a remote compromise, you are (1) fortunate, and (2) probably new. If you have worked a remote compromise, you certainly don't want it to ever happen again.

It's not as useful in a home setting, unless you happen to be running Internet-facing services at home (and some people do). In that case, everything said above applies.

SELinux may be the last thing that stands between your data and an attacker with a 0-day exploit who really wants it. If you can use it, why wouldn't you?

share|improve this answer

I think SELinux just extends traditional permissions system by introducing extended settings over permissions. Does it make your system more secured? I think it depends on how you use SELinux in your applications. Also I'm not good in SELinux but configuring it needs more knowledge over what limitations it can provide you. But it also introduces many problems that you need to manually investigate to overcome

share|improve this answer
    
SELinux does much more than just extend the traditional POSIX permissions. SELinux can limit access to certain network ports, for example. –  wzzrd Apr 7 '11 at 21:16

There is a package that helps users find problems caused by SELinux named setroubleshoot. Install it, set it to run at start. Then when you get an SELinux denial, it will be noted in /var/log/messages. If you're logged into the GUI as well, you'll get a notification.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.