Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the Linux system which provides the SSH shell, Apache front end, role based web application, MySQL DB, memcached, almost all the systems are password protected, then why we need SELinux?

share|improve this question

migrated from stackoverflow.com Dec 29 '09 at 5:16

This question came from our site for professional and enthusiast programmers.

5 Answers 5

You may view SELinux as a system-call firewall: A policy for each application specifies what's reasonable for the application to do: The name server may listen on port 53, work with some zone files in a particular directory, send out syslog, ..., but it makes no sense for it to try to work with files in /home, for example. SELinux' enforcement of such a policy means that it will be much harder for a weakness in the name server to spread to other parts of the system.

I find that SELinux provides real security value. But while it has certainly become easier to work with over the years, it is - unfortunately - still a rather complex system. The good thing is that you may easily turn it off for some services, without having to turn it off for the whole system. Too many (junior?) sysadmins turn of SELinux across the board, as soon as they run into the slightest problem with one service - instead of selectively turning it off for the service causing trouble.

share|improve this answer
    
Curious: "easily turn it off for some services" how? –  Belmin Fernandez Dec 13 '10 at 23:53
    
man -k selinux is a good place to start. Typically, there are *_disable_trans sebools which can be set to disable SELinux on particular services. –  jgoldschrafe Dec 14 '10 at 0:11

Not all security issues can be predicted in advance. If an attacker manages to exploit a weakness in e.g. a third-party httpd module then they have access to the same files that the user httpd is running as does. SELinux further restricts this by limiting them to actions and file contexts that their SELinux domain has access to.

share|improve this answer

I think the term Mandatory Access Control sums it up quite nicely. SELinux gives you a more secure system through a more secure kernel, in large part due to a MAC implementation.

share|improve this answer

SELinux does a good job at exposing the sheer complexity of an entire Linux system.
An interesting aspect of security is the question "what's it doing?"
Well if it is working you might not ever know. If you are running a web server and it has just been staying up, then you might not know a couple of exploits were even tried against your system.
As for private companies, I don't know. If they need the integrity that SELinux brings to the table, then they should.
As for Government, there are public sources (listing of government projects and the like) that seem to point to that MAC is being used, and possible quite heavily. Government systems, depending on deployment and what information a system holds, have to meet certain criteria before being used.
In the end security is really risk management and choosing the right level of effort.
Also security is an on going effort, not something you merely turn on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.