Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience?

Not a lab test, not a white paper, not a best practice, not a CERT advisory, but a real example, something like audit2why showing a real hacking attempt stopped in its tracks?

(If you have no example, please keep commentary in comments instead of Answers.)

Thanks!

share|improve this question

migrated from stackoverflow.com Sep 2 '09 at 15:13

This question came from our site for professional and enthusiast programmers.

    
There is a condition in this question that is hard to answer. The problem is that when systems are not compromised, they don't make the news. They only make the news when they are compromised. And so, there are news about a lot of compromised CentOS systems, that were compromised exactly because their administrators disabled SELinux because they don't want to bother learning how to configure and maintain it. If they didn't have disabled SELinux, they wouldn't have been compromised. –  Juliano Sep 2 '09 at 16:11
    
Thanks, but I wasn't looking for news so much as actual personal experiences. –  kmarsh Sep 2 '09 at 21:14
add comment

2 Answers 2

up vote 4 down vote accepted

How about this from Russell Coker? It is a real life example as he has invited everyone onto his machine as root. At first glance I thought this was nuts but then you realize the power of SELinux to make root somewhat useless.

Here are some real life examples from his site.

share|improve this answer
    
Interesting. In the first link, he gives away root access but (I guess) locks down with SELinux most anything root would normally be able to do. While this is a real computer, it qualifies for real life only in the same way that a reality TV show does. How many SysAdmins would set up a machine this way? The second link is more what I'm looking for. I'll look them over. Thanks! –  kmarsh Sep 2 '09 at 21:17
add comment

SELinux isn't necessarily about protection from hackers; it's about documenting and enforcing policy for how a system behaves. It's a tool in the toolbox that is valuable, but requires skill to use well.

A real life example of how it saves you is something like this:

A vulnerability in an FTP daemon allows an anonymous user to gain root privileges. An attacker uses that vulnerability to access user home directories and steal SSH private keys, some of which do not have a passphrase.


If SELinux is configured to disallow the "Allow ftp services to read and write files in user home directories" policy, the exploit would not be successful, and the policy violation would be logged.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.