Frequently Asked Questions
What is SELinux?
SE(Security Enhanced) Linux is a security feature in the Linux that provides more fine grained access control compared to traditional file permissions. SELinux is enabled by default in Fedora. A centralized policy determines which software can access what resources. For example, network services can be confined to a particular port, Apache web service is restricted to be able to connect to only 80 by default.
Who developed SELinux?
NSA (National Security Agency) developed SELinux initially. It has partnered with Red Hat to continue development and carry out integration of SELinux into Fedora and Red Hat Enterprise Linux. It is not specific to Red Hat however and other Linux distributions and other operating systems have adopted SELinux and similar frameworks.
Is it a firewall?
Though often confused with one, SELinux is not a firewall. A firewall controls the flow of traffic to and from a computer to the network. SELinux can confine access of programs within a computer and hence can be conceptually thought of a internal firewall between programs. Security works best when multiple layers are used and SELinux is a complimentary to a firewall and other security features used in Fedora.
Is it useful on a desktop?
Yes. SELinux policies in Fedora were initially focused on network facing services. However several dozens of desktop software including Firefox, HAL, D-Bus etc are protected by default using SELinux policies in current releases of Fedora.
How do I find out if SELinux is enabled on my system?
SELinux can be
How do I find out whether SELinux is denying access for any sofware?
What is mandatory access control ?
SELinux (Security-Enhanced Linux) in Fedora is an implementation of mandatory access control in the Linux kernel using the Linux Security Modules (LSM) framework. Discretionary access control (DAC) is standard Linux security, and it provides no protection from broken software or malware running as a normal user or root. Users can grant risky levels of access to files they own. Mandatory access control (MAC) provides full control over all interactions of software. Administratively defined policy closely controls user and process interactions with the system, and can provide protection from broken software or malware running as any user.
In a DAC model, file and resource decisions are based solely on user identity and ownership of the objects. Each user and program run by that user has complete discretion over the user's objects. Malicious or flawed software can do anything with the files and resources it controls through the user that started the process. If the user is the super-user or the application is setuid or setgid to root, the process can have root level control over the entire file system.
A MAC system does not suffer from these problems. First, you can administratively define a security policy over all processes and objects. Second, you control all processes and objects, in the case of SELinux through the kernel. Third, decisions are based on all the security relevant information available, and not just authenticated user identity.
MAC under SELinux allows you to provide granular permissions for all subjects (users, programs, processes) and objects (files, devices). In practice, think of subjects as processes, and objects as the target of a process operation. You can safely grant a process only the permissions it needs to perform its function, and no more.
The SELinux implementation uses role-based access control (RBAC), which provides abstracted user-level control based on roles, and Type Enforcement® (TE). TE uses a table, or matrix to handle access controls, enforcing policy rules based on the types of processes and objects. Process types are called domains, and a cross-reference on the matrix of the process's domain and the object's type defines their interaction. This system provides extremely granular control for actors in a Linux system.