5

Are there linux distros without selinux portion in kernel? Sorry if that's dumb question ;), but my distro (debian) has it and i see that it's in kernel on kernel.org so i was wondering if it's so popular that every distro has it or some delete this portion of kernel and use something else? If there are distros without this kernel part (and i mean totally deleted, not just disabled and waiting for being enabled on boot like in debian) could you give some examples?

Improve this question
5
  • 1
    for me it seems ubuntu ships the kernel with selinux $ grep -i selinux /boot/config-2.6.24-23-generic CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_DISABLE=y # CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT is not set # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
    – Istvan
    Commented Aug 31, 2009 at 15:50
  • If it's not actually enabled by default, why do you care?
    – koenigdmj
    Commented Aug 31, 2009 at 16:02
  • What do you have against selinux?
    – Zoredache
    Commented Aug 31, 2009 at 16:02
  • 2
    well, maybe i want to use something else. what you have against someone controlling his own machine and disabling 'security' features which he found to not be as effective as their authors claim? there are some vulnerabilities which are easier to exploit with selinux enabled.
    – Phil
    Commented Aug 31, 2009 at 17:19
  • 2
    I can't speak for Phil, but in my opinion, any utility that breaks much, much more than it fixes is a candidate for avoidance.
    – kmarsh
    Commented Aug 31, 2009 at 18:58

6 Answers 6

Reset to default
4

If you are concerned about which modules and features are compiled into your kernel, you should maintain your own kernel, compiled by you. Debian has a system named make_kpkg to facilitate this process. You can copy over a stable config from /boot to the new kernel source tree and load that into your custom build so you don't have to configure everything from scratch. Then you have complete freedom to manually scan through every single kernel configuration setting, including SELinux.

Improve this answer
1

while it is in the vanilla kernel i presume every distro ships the system with that part enabled.

You can only disable it or recompile your own kernel without it.

title SE-Linux Test System
        root (hd0,0)
        kernel /boot/vmlinuz-2.4.20-selinux-2003040709 ro root=/dev/hda1 nousb selinux=0
        #initrd /boot/initrd-2.4.20-selinux-2003040709.img
Improve this answer
2
  • that doesn't directly answer my question, but maybe recompiling kernel isn't that bad idea, +1
    – Phil
    Commented Aug 31, 2009 at 15:31
  • 1
    check you kernel config: CONFIG_SECURITY_SELINUX=y i presume this is the default for all teh major linux distros
    – Istvan
    Commented Aug 31, 2009 at 15:51
1

Ubuntu and Suse don't come with it in the default kernel, as they use app armor instead. I believe Gentoo uses GRsecurity, so doesn't come with it by default either

Improve this answer
1
  • hardened Gentoo, uses SElinux, but normal Gentoo doesn't.
    – Chris Huang-Leaver
    Commented Sep 1, 2009 at 10:55
0

The Wikipedia article on SE-Linux has a list of distros that use it.

Not being mentioned doesn't mean others don't, but I'd look with ones not on the list first :)

Distrowatch is a good spot to watch for updates on current and new distros.

Improve this answer
0

Slackware Linux uses vanilla kernels.

Improve this answer
1
  • 2
    selinux IS on vanilla kernels
    – drAlberT
    Commented Aug 31, 2009 at 15:21
0

SELinux ships with Debian, but it's disabled by default. There is a lot you need to do to enable it, so I wouldn't worry. The only reason it's there is because a lot of companies that use Debian on their servers require SELinux -- so Debian offers it as a choice, but doesn't force it on any of it's users.

Improve this answer
2
  • 1
    yes, but it's still there. just 'disabled' but it's there.
    – Phil
    Commented Aug 31, 2009 at 17:48
  • 1
    So why not compile a vanilla kernel from kernel.org without SELinux?
    – Michael Pobega
    Commented Aug 31, 2009 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .