Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there linux distros without selinux portion in kernel? Sorry if that's dumb question ;), but my distro (debian) has it and i see that it's in kernel on kernel.org so i was wondering if it's so popular that every distro has it or some delete this portion of kernel and use something else? If there are distros without this kernel part (and i mean totally deleted, not just disabled and waiting for being enabled on boot like in debian) could you give some examples?

share|improve this question
    
for me it seems ubuntu ships the kernel with selinux $ grep -i selinux /boot/config-2.6.24-23-generic CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_DISABLE=y # CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT is not set # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set –  Istvan Aug 31 '09 at 15:50
    
If it's not actually enabled by default, why do you care? –  koenigdmj Aug 31 '09 at 16:02
    
What do you have against selinux? –  Zoredache Aug 31 '09 at 16:02
    
well, maybe i want to use something else. what you have against someone controlling his own machine and disabling 'security' features which he found to not be as effective as their authors claim? there are some vulnerabilities which are easier to exploit with selinux enabled. –  Phil Aug 31 '09 at 17:19
1  
I can't speak for Phil, but in my opinion, any utility that breaks much, much more than it fixes is a candidate for avoidance. –  kmarsh Aug 31 '09 at 18:58
add comment

6 Answers

up vote 4 down vote accepted

If you are concerned about which modules and features are compiled into your kernel, you should maintain your own kernel, compiled by you. Debian has a system named make_kpkg to facilitate this process. You can copy over a stable config from /boot to the new kernel source tree and load that into your custom build so you don't have to configure everything from scratch. Then you have complete freedom to manually scan through every single kernel configuration setting, including SELinux.

share|improve this answer
add comment

SELinux ships with Debian, but it's disabled by default. There is a lot you need to do to enable it, so I wouldn't worry. The only reason it's there is because a lot of companies that use Debian on their servers require SELinux -- so Debian offers it as a choice, but doesn't force it on any of it's users.

share|improve this answer
    
yes, but it's still there. just 'disabled' but it's there. –  Phil Aug 31 '09 at 17:48
1  
So why not compile a vanilla kernel from kernel.org without SELinux? –  Michael Pobega Aug 31 '09 at 17:50
add comment

Slackware Linux uses vanilla kernels.

share|improve this answer
2  
selinux IS on vanilla kernels –  AlberT Aug 31 '09 at 15:21
add comment

Ubuntu and Suse don't come with it in the default kernel, as they use app armor instead. I believe Gentoo uses GRsecurity, so doesn't come with it by default either

share|improve this answer
    
hardened Gentoo, uses SElinux, but normal Gentoo doesn't. –  Chris Huang-Leaver Sep 1 '09 at 10:55
add comment

The Wikipedia article on SE-Linux has a list of distros that use it.

Not being mentioned doesn't mean others don't, but I'd look with ones not on the list first :)

Distrowatch is a good spot to watch for updates on current and new distros.

share|improve this answer
add comment

while it is in the vanilla kernel i presume every distro ships the system with that part enabled.

You can only disable it or recompile your own kernel without it.

title SE-Linux Test System
        root (hd0,0)
        kernel /boot/vmlinuz-2.4.20-selinux-2003040709 ro root=/dev/hda1 nousb selinux=0
        #initrd /boot/initrd-2.4.20-selinux-2003040709.img
share|improve this answer
    
that doesn't directly answer my question, but maybe recompiling kernel isn't that bad idea, +1 –  Phil Aug 31 '09 at 15:31
    
check you kernel config: CONFIG_SECURITY_SELINUX=y i presume this is the default for all teh major linux distros –  Istvan Aug 31 '09 at 15:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.