Welcome to SELinux Articles!
SELinux is a topic covered in media more than you may realize. Here is a comprehensive list from Linuxsecurity.com, the central voice of Linux and Security issues, for every article regarding SELinux. A great overview of past topics in the SELinux environment.

Curious about what people were talking about in 2002? Or wanted to find articles on the ups and downs of SELinux adoption? Take a look at the history of SELinux as developers, journalists, bloggers talked about some of the capabilities, pitfalls and events that have transpired since the beginning.

SELinux Articles

  • SELinux blocks loading kernel modules
    The kernel has a feature where it will load certain kernel modules for a process, when certain syscalls are made. For example, loading a kernel module when a process attempts to create a different network socket.

  • SELinux and --no-new-privs and the setpriv command
    SELinux transitions are in some ways similar to a setuid executable in that when a transition happens the new process has different security properties then the calling process. When you execute setuid executable, your parent process has one UID, but the child process has a different UID.

  • How come MCS Confinement is not working in SELinux even in enforcing mode?
    MCS separation is a key feature in sVirt technology. We currently use it for separation of our Virtual machines using libvirt to launch vms with different MCS labels. SELinux sandbox relies on it to separate out its sandboxes. OpenShift relies on this technology for separating users, and now docker uses it to separate containers.

  • libselinux is a liar!!!
    On an SELinux enabled machine, why does getenforce in a docker container say it is disabled? SELinux is not namespaced This means that there is only one SELinux rules base for all containers on a system. When we attempt to confine containers we want to prevent them from writing to kernel file systems, which might be one mechanism for escape. One of those file systems would be /proc/fs/selinux, and we also want to control there access to things like /proc/self/attr/* field.

  • Stop disabling SELinux!
    The push to cloud transforms the way we apply information security principles to systems and applications.

  • Why SELinux is more work, but well worth the trouble
    Many of us got used to the simple owner, group, and other model of Unix security so long ago that we were somewhat taken back when the setfacl and getfacl commands were introduced and added complexity to file permissions. All of a sudden, users and groups could be assigned access privileges separately from these three groupings and we had to pay attention to + signs at the ends of our permissions matrices that reminded us that additional access permissions were in effect.

  • Read Signal Magazine's Interview with IA Director Schaeffer
    The October edition of Signal Magazine features an extensive interview with IA Director Dick Schaeffer on the Nation’s broad and vigilant efforts to “maintain the edge in information assurance.” In the interview, Mr. Schaeffer discusses the information assurance challenges presented by the widespread reliance on commercial technologies, by information sharing across diverse communities of interest, and by the need for cryptographic interoperability in a secure environment, a need addressed by the Suite B strategy.

  • Walsh: Cool things with SELinux... Introducing sandbox -X
    Red Hat SELinux hacker Dan Walsh has a weblog posting about a new feature added to his SELinux sandbox. sandbox -X essentially combines the sandbox with the idea behind the "xguest" user to create a sandbox for arbitrary desktop applications. It came out of a request to be able to sandbox "acroread": "Acroread and most other desktop applications use multiple communication channels, interacting not just with stdin and stdout, but accessing configuration files, directly or using interprocess calls as with GConf, the X server and other applications, and usually have full run of the user's home directory.

  • Secure Virtualization Using SELinux (sVirt)
    While virtualization seems to be next big thing, providing great opportunities in resource allocation, system management, savings on power and cooling, and the ability to grow and shrink resources depending on demand. But what about the security? What happens when a cracker breaks into a virtual machine and takes it over? What happens if there is a bug in the hypervisor?

  • The Cost of SELinux, Audit, & Kernel Debugging
    When benchmarking development releases of Fedora in particular, they often end up being much slower than the final build and perform lower when compared against some of the other leading desktop distributions. As we have mentioned in previous articles, this is generally due to the debugging support enabled within the development builds of Fedora. To see just what the performance cost is, we have compared the Fedora 11 performance of the normal kernel against the kernel-debug package. Additionally, we also compared the performance when disabling SELinux and system auditing support.

  • Introducing SELinux Sandbox, Confines Untrusted Binaries
    Here's an OS News link to a LKML discussion with Eric Paris. Looks intersting.Eric Paris, a SELinux developer, has announced today a new SELinux feature: "Dan and I (mostly Dan) have started to play with using SELinux to confine random untrusted binaries. The program is called 'sandbox.' The idea is to allow administrators to lock down tightly untrusted applications in a sandbox where they can not use the network and open/create any file that is not handed to the process. Can be used to protect a system while allowing it to run some untrusted binary."

  • Security Changes In The 2.6.28 Kernel
    Version 2.6.28 of the Linux kernel was released during Christmas, so I thought it'd be worthwhile waiting until after typical vacation days to post a summary of changes to the security subsystem. As always, thanks to the Kernel Newbies folk who track major kernel changes. Serge Hallyn added a dummy policy for SELinux to the kernel tree. This is useful for testing SELinux and a base for building minimal and experimental security policies. Have you noticed some of the security changes to the latest upstream Linux kernel? Read on for more information on these changes.

  • SE Linux and Decrypted Data
    There is currently a discussion on the Debian-security mailing list about how to protect data which came from an encrypted file. I was going to skip that one until someone summoned me by mentioning SE Linux. The issue which was raised is that data from an encrypted file can be read from /dev/mem (for all memory of the machine) or /proc//mem (for the memory of the process). It was suggested that SE Linux can prevent such attacks, however it’s not that simple. How do you secure data that came from an encrypted file? This article takes the position that SELinux is the answer. Do you agree after reading it?

  • Upcoming Conference Talks on SELinux Applications: sVirt and Kiosk Mode
    Recently, I've been busy getting the initial cut of sVirt out, and am currently processing community feedback before issuing an update. The basic idea behind sVirt is to apply MAC label security (SELinux, Smack etc.) to Linux-based virtualization schemes such as KVM, allowing the existing OS-level security mechanisms to be re-used for process-based VMs. This is an application one of the core advantages of Linux-based virtualization, where generally, all of the Linux process management infrastructure within the kernel and wider OS may be applied to domains which run inside Linux processes. Would you agree that we don't need to modify the kernel security mechanism for MAC label security? Read on for more information.

  • Upcoming Conference Talks on SELinux: sVirt and Kiosk Mode
    Recently, I've been busy getting the initial cut of sVirt out, and am currently processing community feedback before issuing an update. The basic idea behind sVirt is to apply MAC label security (SELinux, Smack etc.) to Linux-based virtualization schemes such as KVM, allowing the existing OS-level security mechanisms to be re-used for process-based VMs. This is an application one of the core advantages of Linux-based virtualization, where generally, all of the Linux process management infrastructure within the kernel and wider OS may be applied to domains which run inside Linux processes. This article looks at some interesting development in the SELinux project. What would you like to see in SELinux?

  • Virtual Desktops, Real Security
    Deep inside a nameless government department — you will probably guess its identity, but nobody can say it officially — a Linux desktop revolution has taken hold. For this particular organization, however, the big deal is not the fact that Linux is involved, but the way in which it is being used. What do you think? Will virtualizing the desktop make it more secure? This article looks at how virtualization and SELinux can help make an organization's desktops more secure.

  • SELinux and Security Changes in the 2.6.27 Kernel
    This patch by Stephen Smalley addresses the case where "alien" SELinux security labels need to be written to the local filesystem, for example, in the case of building RPMs where the local policy is different to the policy on the system where the RPM is to be installed. This will help with enabling SELinux on build systems (e.g. in the Fedora infrastructure) and more generally with packagers and ISVs shipping third party policy with RPMS. In the recently released 2.6.27 kernel there are some functional changes in security particularly in SELinux. This article looks at those changes.

  • SELinux Memory Protections are Your Friend
    I don't know what a Zend Optimizer is, but it apparently does not play well with SELinux. I've encountered a blog entry by someone who has tried to do the right thing and keep SELinux enabled, after finding the code for a policy module which makes this stuff work. When loaded, this will enable the web server to execute memory on its heap, stack or certain types of executable memory allocated via mmap(2). These are well-known attack vectors and disable some very important memory protection mechanisms. See Ulrich Drepper's SELinux Memory Protection Tests for details. What to do when SELinux does not work with a software that you want to run? This article looks into how memory protection in SELinux maybe the cause of the problem.

  • OpenSUSE Adds SELinux
    Beginning with openSUSE 11.1, SUSE users will have an additional option regarding security frameworks. In addition to AppArmor, we will be adding SELinux capabilities in openSUSE 11.1, which will allow users to enable SELinux in openSUSE if they wish. Have you hear that openSUSE 11.1 will have the options to enable SELinux? My question is how useful will enabling SElinux on SUSE will be without a useful security policy? I guess we will have to wait and see if this move will help the distributions security.

  • New SELinux Userland Project Site
    Tresys have announced the launch of a new source repository, bugtracker and wiki for the SELinux userland code, which may be found here. The site utilizes trac for project management and git as the source code management system. Developers should use this new repository instead of the old sourceforge site. Have you heard that Tresys has created a page for SELinux userland projects? There is some great information on it if you are interested in SELinux.

  • LinuxWorld Preview: IBM Engineer Touts SELinux
    SELinux has achieved its goal of protecting Linux systems from intrusion by unauthorized access. But the effort remains in the early adopter stage, and its supporters need to work on broader implementation and greater ease of use, according to Doc Shankar, an IBM Corp. distinguished engineer. In a preview of his LinuxWorld Conference & Expo workshop, Shankar said that the biggest benefit of SELinux is that systemwide policies automatically and absolutely enforce access controls. No one gets the unrestricted access of a "root" superuser; instead, each user is confined to what he needs to know, he said. In the case of a breech, an intruder is boxed in and can destroy only a portion of the system, he said. This article is an interesting look at one IBM Engineer's opinion about SELinux. Do you agree with what he says?

  • CDS Framework Toolkit 3.0 Released
    Tresys have announced the release of version 3.0 of their CDS (Cross Domain Solutions) Toolkit, an Eclipse-based IDE for developing CDSs with SELinux. Notable features introduced in this release include support for MLS and labeled networking, with enhancements to end user customization of generated policy and to the general development environment. Do you use any IDE programs to write and develop your SELinux policy or do you use a basic editor like vi? Which is better or more productive?

  • SELinux and Fedora
    Red Hat has undoubtedly done more to make SELinux usable than any other organization, but has it actually reached the point where it can be enabled by default for all desktops? The Fedora project clearly thinks so. Not only is SELinux enabled, but the installer no longer has an option to disable it or to put it into "permissive" mode. Most of the posts in a thread on the fedora-devel mailing list see that as the right choice, but some are not so sure. This article looks at how SELinux is working on the Fedora desktop. It brings up a interesting question on how useful is SELinux on a Linux Desktop? What do you think?

  • Principle of Least Privilege Prevails, Says Red Hat Security Expert
    Linux security may seem daunting, but there are a host of best practices to simplify the maze. Recently, Steve Grubb of Red Hat Inc. outlined some important security principles, including minimizing admin access, the increasing sophistication of SELinux and the importance of auditing systems. Like many when I think about least privileges, I think about SELinux. What do you think about? This article is a interview with a Red Hat expert that answers questions about SELinux and least privileges.

  • Ruby Bindings for libselinux
    Dan Walsh has announced preliminary Ruby support for libselinux (the core SELinux management library). This is to enable the integration of the Puppet systems management tool with SELinux, and should also allow other Ruby applications to be similarly integrated. I can see some uses for this but how many ruby applications will be using these binding for libselinux? Will we see more programming language having binding to this SELinux library?

  • Reference Policy 20080702 Released
    Chris PeBenito has announced the latest release of Reference Policy. Notable changes in this release include the ability to specify SELinux roles in loadable policy modules, improved labeled networking support, and new policy modules for virtualization packages. This release improved the functionality of SELinux loadable policy modules. With this update SELinux seems to be in the right direction, what do you think?

  • Take a look at NetLabel Tools 0.18
    Paul Moore of HP has announced the release of version 0.18 of NetLabel Tools, a suite for managing explict labeled networking (i.e. attaching labels to packets via IP options) under Linux. This release adds support for static and fallback labels in the 2.6.25 kernel, in addition to several bugfixes and enhancements. Do you use SELinux for on your system to improve it's security and use NetLabel? If so what do you think about it? Does it help make managing a SELinux installed machine?

  • Core SELinux Version R080611 Released
    The NSA have announced the release of updated version of the core SELinux code, available from their web site. This release includes support for permissive domains (allowing permissive mode on a per-domain basis), user and role mapping via sepol, and various minor fixes and enhancements.

  • SELinux and Ubuntu
    Security-enhanced Linux (SELinux) was originally developed as a research prototype of the Linux® kernel and a number of utilities with enhanced security functionality designed to demonstrate the value of mandatory access controls to the Linux community and how such controls could be added to Linux. Today SELinux is integrated into the mainline Linux 2.6 kernel series and several Linux distributions. The Security-enhanced Linux kernel contains new architectural components originally developed to improve the security of the Flask operating system. Have you used the latest Ubuntu version with SELinux enabled? If so what was your experience? This article is a step by step guide to learning how-to setup SELinux with Ubuntu. Test it out and let us know how it goes.

  • User Access Control in Drupal 6
    In this article by David Mercer, we will look at an entirely different aspect of running a Drupal website. Once we have added the functionality to the site, we now have to give some thoughts about how this functionality is to be accessed, or by whom. As the site grows, you will most likely feel the need to delegate certain responsibilities to various people. Alternatively, you might organize a team of people to work on specific aspects of the site. Whatever is required, at some stage you will have to make decisions about who can do what, and Drupal makes sure that it is possible to do precisely this. This article on access control in Drupal has many similarities to implementing policies in SELinux. For those of you who are new to SELinux and are unsure of how "it works", this article may provide insight through a practical example of roles and permissions in a microcosm CMS world.

  • 2008 SELinux Developer Summit Call for Participation
    The SELinux Developer Summit will be a one day summit intended to provide a forum for focused technical discussion regarding current and future development plans for SELinux and related Flask/TE projects. The intended audience will consist of current SELinux developers, system/security administrators, distribution organizers/packagers, and power users. The format will be a mix of presentations and moderated discussion, including a panel where attendees will be invited to submit questions and feedback. The SELinux Developer Summit is looking for people to take part in the action. Will you be one of them?

  • Reference Policy 20080402 Is Here
    Tresys have announced the release of the latest version of Reference Policy. A notable highlight in this release is the addition of core infrastructure for X window (XACE/XSELinux). There’s also new support for wireshark, policy refinements for several already supported applications, and general enhancements including 64-bit capability support and updates for labeled networking. One interesting part of this release is XSELinux. Do you think this will improve the usability and security of x-windows? I personal don't have any experience with (XACE/XSELinux) so if anyone does feel free on make a comment about it.

  • SELinux Labeling of Xen Images Labeling of Xen Images
    A place people sometimes trip with SELinux is the labeling of files. SELinux requires files to be labeled correctly in order to function. Discretionary Access Control has the same requirement in that file must have the correct permissions and ownership. If a file does not have the correct permissions it can not be read, written or executed. Similarly if a file is not labeled correctly SELinux will prevent read/write/execute as well as many other permissions and transitions. Are you a Xen user? If so this article will show you steps to increase your images security by using SELinux.

  • What is SE-PostgreSQL?
    If you're curious about how SELinux work with a database, and want to take your understanding to the next level, this is a great way to get started: Security-Enhanced PostgreSQL (SE-PostgreSQL) is a security extension built in PostgreSQL. It works as a reference monitor within relational database management system, and provides fine-grained mandatory access control features collaborating with SELinux and its security policy. These features enable to deploy a database management system into data flow control scheme, integrated with operating system. We call the most characteristic feature of SE-PostgreSQL as ''system-wide consistency in access controls''. Any other RDBMS cannot provide this feature in current.

  • Core SELinux Version Released
    The NSA have announced the latest release of the core userland SELinux code. According to the changelog, changes in this release include support for policy capabilities (i.e. allowing features to be selectively implemented in policy), several enhancements to libselinux, optimized matchpathcon, improved error handling and various bugfixes. The release may be downloaded here. Also noted in the release is a new page on the NSA site: Related Work, providing links to information on the underlying architecture and non-Linux implementations.

  • So, would you call it SESolaris? SEOpenSolaris?
    We had mentioned last week that Solaris has introduced the FLASK security framework (part of the heart of SELinux) into its system. This week, a number of sites are chiming in, and this blogger has a couple of great links as well... In a major validation of the FLASK architecture, the OpenSolaris community has created a new project called Flexible Mandatory Access Control (fmac) to adapt the FLASK architecture to OpenSolaris. (The FLASK architecture that is the basis for SELinux.) Stephen Smalley will be one of the community leads. OSNews picked up the email thread today with some interesting comments.

  • SELinux Blocks Real-World Exploits
    SELinux still has a ways to go before it becomes the standard for secure servers. But as time passes, more and more administrators are realizing that this isn't some addition that needs to be switched off - it's an incredibly effective tool that when used correctly, can stop real-world exploits from causing real-world problems. In this article, Network World gives a soup-to-nuts overview on the current state of SELinux and how it is one of the most capable ways administrators can lock-down their system. Linux security experts are reporting a growing list of real-world security situations in which the US National Security Agency's SELinux security framework contains the damage resulting from a flaw in other software. These so-called "mitigations" are showing that a Linux feature that began as an esoteric security measure is starting to prove its worth. What are your thoughts?

  • Role-based access control in SELinux
    Serge E. Hallyn, in his follow up to SELinux from Scratch goes into more detail on how best to utilize SELinux to its fullest potential. In this particular example, he uses the metaphor of writing a policy over a cash-register system... Very useful overview indeed. The security policy implemented in Security-Enhanced Linux (SELinux) is type enforcement (TE) under a layer of role-based access control (RBAC). (SELinux also orthogonally implements multi-level security (MLS), which is outside the scope of this article.) TE is the most visible, and therefore the most well known, server because it enforces fine-grained permissions: when something breaks because of unexpected access denials, TE is most likely responsible. In TE, a process's security domain (its domain of influence over the system) is determined by the task's history and the currently executing program.

  • Uncovering the secrets of SE Linux: Part 1
    It's always good to take a look back right? Here we have one of the very first overviews after the introduction of SELinux into the community. And most of all, its really interesting to see how far SELinux has come. From "don't expect it to be ready for prime time" to its inclusion by default in Fedora Core, EnGarde Secure Linux and even Ubuntu Hardy, SELinux has really come a long way. Sure, its home is really to be found on the server (not the desktop), but this is one way of looking back. And for those who still don't know too much about SELinux, you won't find many better (if thorough) overviews. Good stuff...

  • Top 10 SELinux Stories of 2007
    2007 was an interesting year for SELinux. Many issues were important and gained exposure, but what did you, the reader have to say about the most important articles in SELinux? There are many ways to judge this and one of them is by listing the most popular articles as chosen by our readers over the course of the year, based on hits. It isn't the only answer, but certainly an interesting one. Click through to see the list of the Top SELinux stories on Linuxsecurity.com for 2007. Also: For a COMPLETE list of all the SELinux articles that have ever appeared on LinuxSecurity.com, go here Easy to follow and organized by year, it's one of many, many resources avaialable at EnGardelinux.org with regards to SELinux.

  • 5 Ways SELinux may surprise you...
    This is one of the best overviews on some misconceptions and trends regarding SELinux that we've seen in awhile. If you are just beginning to get a feel for SELInux, or still aren't sure what it is, read this article. In the column that follows, author and SELinux expert Frank Mayer will walk you through five of the ways that this venerable Linux security technology may surprise you. By now, most people in the Linux world have heard of Security Enhanced Linux (SELinux). Since its initial release by the National Security Agency in 1999, SELinux has become a standard part of the Linux kernel and a supported capability in many Linux distributions including Red Hat Enterprise Linux 4 and 5.

  • Tips for Taming SE Linux, Part Two
    Last week we took the eagle's eye view of the principles behind SELinux. Today we'll dig a bit more deeply into SELinux policies, and then fire up Fedora 8 and see what SELinux looks like in practice. I recommend using the latest Fedora version as a SELinux training tool, because Fedora has the most mature implementation and userspace tools. Red Hat Enterprise Linux and CentOS, the leading Red Hat clone, have similar SELinux setups to Fedora. Gentoo also has a nice SELinux implementation. I don't recommend starting from scratch. Start with a working setup, and then plan to spend considerable time learning your way around it, because it is a big complex beast. SELinux is a huge security framework but this articles does a good job at taking a look at one part at a time. The next time a program is not working correctly with SELinux turned on, try to debugging the problem and add some SELinux policy.

  • Tips for Taming SELinux
    Wanted to learn a few more tips on SELinux and get a feel for what it does? Carla Schroeder chimes in again regarding SELinux as a whole and its policies: An SELinux policy has no concept of an all-powerful superuser, but only what is allowed and what is not allowed. It takes away the destructive potential of root. A successful intrusion will be confined to the process that it compromises, and will not be able to escalate beyond it. Sounds a bit like a chroot jail, doesn't it?

  • Developer Interview: Dan Walsh from SELinux
    Fedora takes a some time and interviews Dan Walsh, one of the project leads on SELinux development. They ask him a couple questions about SELinux, open source and what he's been doing at Red Hat: We all appreciate that when we turn on our Linux systems they're pretty secure. Thanks to continuing improvements to SELinux, it is increasingly easy for users to take advantage of this powerful security tool. Read on to find an interview with Daniel Walsh, the principal developer of SELinux in Fedora from Red Hat, where he tells us more about what SELinux does and how it's improved in Fedora 8. Also included are some screenshots which show-off the new policy creation GUI.

  • SEEdit 2.2.0 Released
    Yuichi Nakamura has announced the release of version 2.2.0 of SELinux Policy Editor (SEEdit). This release includes support for Fedora 8 and embedded systems. The performance of the simplified policy compiler has been improved, and it also now supports cross compilation of policy. Do you like using these types of SELinux editing tools? The purpose of theses tools is to help make administrating a system with SELinux enabled easier. Do you feel they help?

  • Samba/SELinux Policy
    One of our featured blogs, Dan Walsh provides a HOWTO on creating an SELinux policy. In this blog I will actually walk through the Samba SELinux policy. As you know Policy is made up of three files, File Context (FC) Type Enforcement (TE) and an Interface file (IF) This is an extremely thorough and detailed overview.

  • Is SELinux leveling multi-level security?
    Just how much is security, especially in high-demand Government sectors, going to be driven and how is SELinux going to play a part? This is a very interesting analysis on how SELinux has the opportunity to be so effective at locking down a system, it could devalue the current break up of security solutions. Interest in multi-level security in the intelligence and Defense agencies seems to be high right now, because it would allow analysts to access networks of multiple security levels with one machine. Now (so we hear) analysts may have two or three PCs in their office, one for each security level. The case he makes is that SELinux has the potential to negate these different levels and systems. Could SELinux have that kind of effect or are high-demand users still going to expect multiple systems?

  • Managing SELinux with SETools
    Configuring high-end SELinux (Security-enhanced Linux) policies can be a daunting challenge to system administrators, especially those who are new to the concepts and processes. But there are a number of useful tools available that will help you write, analyze and report on your policy. In this tip we'll look at one of these tools: SETools, a free open source product from Tresys Technology. This takes you through the capabilities of SETools, installing on your system and testing it out. With some emphasis on graphical tools and varied capabilities, this is a very useful resource.

  • SELinux sparks tussle over Linux security model
    This issue has been bantered around for almost a month now, and it seems that when they are addressing the future of the security in the Kernel, many different issues are still developing. As he states in the article: Last night, another developer, Thomas Fricaccia, urged that "a free and open operating system should preserve as much freedom for the end-user as possible. ... 'Freedom' includes the power to do bad things to yourself by, for example, making poor choices in security frameworks. This possible and permitted end result shouldn't be the concern of kernel developers." So how far can this discussion go? Is too much emphasis being placed on the kernel instead of the applications? Will this continue to be discussed this feverishly?

  • Kernel Space: A Simplified Security Framework for Linux
    Read the latest news on SMACK (Simplified Mandatory Access Control Kernel) and get some more insight into the current security debate concerning the beloved Linux kernel. Let us know your thoughts on SELinux's role (no pun intended) with the kernel as well as any thoughts in SMACK. How does it live up to its intent for "simplicity of administration"?

  • Linus Torvalds on SELinux
    Continuing his outspoken nature, Torvalds reigns in on the issues between LSM and SELinux. The argument as to which method should be the foundation, is being hotly debated. "You security guys are insane..." Torvalds states. What's he judging? the value of SELinux as the framework (maybe it's good, maybe it's not) or something else? Why are security experts the focus? It seems here, that Torvalds is focusing on the source, not the content or issue itself. Aren't we past that?

  • Simplified Mandatory Access Control Kernel
    Smack is the Simplified Mandatory Access Control Kernel," Casey Schaufler said posting the third version of his patchest. He explained, "Smack implements mandatory access control (MAC) using labels attached to tasks and data containers, including files, SVIPC, and other tasks. Smack is a kernel based scheme that requires an absolute minimum of application support and a very small amount of configuration data." It's always nice to have security at the kernel level - how does SMACK stack up to other security implementations? Have you been able to configure something similar with a good set of SELinux rules?

  • Is SELinux Really too Complex?
    What I discovered is that part of SELinux’s current dilemma is more easily fixable than the other, because it has nothing to do with technological chops and everything to do with public perception. Jim Klein, the director of information services and technology at the California-based Saugus Union School District, put it best: “The biggest problem for SELinux is mindshare,” Klein told me. Why do users think that SELinux is too hard to use? One reason, could be that it can prevents some of our favorite Linux programs from running, if we don't make changes to the default SELinux policy. I find the standard set of SELinux tools to be a great aid in getting SELinux working on in any Linux enviroment.

  • Core SELinux Version R070925 Released
    Stephen Smalley has announced the latest release of core SELinux userland code, with highlights including dynamic object class and permission discovery, per-command PAM configuration for the newrole utility, and several general updates and improvements. This release update some of the SELinux core userspace programs. One interesting change is per-command PAM configuration for the userland command newrole. I am glad to see updates to the userspace utilizes being release on a regular bases. Do you think that the NSA is pushing SELinux in the right direction?

  • Introduction to SELinux
    As SELinux continues to gain in popularity, more and more sites will take it upon themselves to give it another go around. Here is a great, quick intro from another standpoint, into SELinux and setting up the system. Also nice, is the explanation of DAC versus MAC, and how they inter-relate. If you haven't learned much about SELinux, here's a nice way to start.

  • SELinux Policy Development - A Nice Overview
    Customizing your systems SELinux policy can be necessary when running an application your policy is unaware of. Particularly, web based applications might need customization of Apache policy in order to run properly. SELinux development is a very useful skill to have. With this skill the next time you are thinking about disabling SELinux you will know what changes are needed to the policy to get any program working with SELinux. How many of use end up disabling SELinux because it's preventing our favorite program from running?

  • First Release of SE-PostgreSQL
    KaiGai Koehi has announced the first release of SE-PostgreSQL, with RPMS available for Fedora 7, and documentation in Japanese and English. Security-Enhanced PostgreSQL (SE-PostgreSQL) is a security extension built into PostgreSQL. I am happy to see projects like this one. I wonder if other projects are going to pop up similar to this one?

  • Explore the Updated SLIDE and SETools
    Tresys have released new versions of SLIDE (announcement) and SETools (announcement). The new SLIDE release (v1.2) includes a network configuration GUI, usability improvements and bugfixes, while the new version of SETools (v3.3.1) is a minor bugfix release. I have recently tested out SLIDE a SELinux development plug-in for Eclipse. I found that the plug-in gives the user at lot of information about the policy which is being developed on. After using it I have been thinking about doing all myy SELinux development on SLIDE instead of vi. What tools do you use for your policy hacking?

  • Is SE Linux only for Linux?
    Another example of SE Linux access controls on a non-Linux platform is the MAC framework in the TrustedBSD project. This implements SE Linux access controls on top of FreeBSD. From reading the documentation it seems that the amount of changes required to the SE Linux code base for implementation on TrustedBSD was significantly smaller than the changes required for Darwin. I was surprised to see that other Unix based operating systems are porting SELinux for example, the OpenBSD project. Since SELinux is implementing in both kernel space and user space I would think there would be a lot of core changes to SELinux to make it work on other operating systems.

  • New Versions of SLIDE and SETools
    Tresys have released new versions of SLIDE (announcement) and SETools (announcement). The new SLIDE release (v1.2) includes a network configuration GUI, usability improvements and bugfixes, while the new version of SETools (v3.3.1) is a minor bugfix release. SLIDE is a Eclipse plug-in for SELinux development. When I do my policy development I stick with my good old vi editor. Personal I find using a IDE for writing policy makes it go slower. Do you find the SLIDE plug-in better then using a terminal editor?

  • A Step-by-Step Guide to Building a New SELinux Policy Module
    I know in the past few weeks I've been very "offense-oriented" - lots of discussions on the latest cracks, DefCon post-analysis, etc. Let's switch back to a good defense scheme with a great starter article on building SELinux policies. Be sure to read the comments at the end warning users on placing too much trust in audit2allow output - this is something many first timers take for granted that could lead to holes in your security layers. In this article's case, the best defense is...well, a great defense!

  • Don’t Disable SELinux!
    We all know that we should not turn off SELinux but how many of us really do keep it on? As I see SELinux grow, so too the number of people keeping their SELinux implementation in enforcing mode. This article states that many companies are developing new software to make using SELinux easier. How would these tools affect the SELinux policy security?

  • SELinux Constrains Samba Vulnerability
    One thing that I have been a little lax about reporting is when SELinux has mitigated a vulnerability. This past week, two Samba vulnerabilities were fixed in an Red Hat Network Update. These fixes were available at the same time as public disclosure of the issues, There are no currently known public exploits of Samba available. This errata fixed two bugzillas #239774 and #239429. I would like to point out that even with these vulnerabilities being able to leverage a heap overflow to run arbitrary code on a recent RHEL is hard.

  • Secure Networking With SELinux
    During the last year quite a bit of effort has gone into improving SELinux’ networking support, thanks to the great SELinux community. While this support is still evolving it will be very beneficial for people to try it out and give feedback so the final result is useful to more users and meets the security needs of a wider audience. As the network support in SELinux continues to evolve (there are already other ideas being discussed for possible inclusion) I’ll try to keep this post updated so that people who find it will have the latest information available.

  • SELinux Gets a Wiki
    The developers of one of the most secure operating systems available will use one of the most open collaboration platforms to continue work. The development community for SELinux will can start to use a newly created wiki site for collaboration and discussion, announced James Morris on the SELinux mailing list last week.

  • SELinux Policy Editor: Removing micromanagement from administrative control
    Administrators often criticize Security Enhanced Linux (SELinux) policies for being too complex, and they have a point. Mandatory access control-based administration is tedious and easy to misconfigure. It can be tough to handle the extended security attributes across a range of users, processes and files or directories that encompass more than one server. Novell addresses this problem in its enterprise-class server offerings with the AppArmor suite of policy management applications, but nothing comparable exists yet for systems management in Red Hat enterprise servers (or CentOS derivatives).

  • An easy way to deploy SELinux?
    The good thing about SELinux (Security-Enhanced Linux) is that it can really help you lock down a Linux system. The bad thing about SELinux is that it can be a real pain to put all those locks and chains in place in the first place.

  • SELinux from Scratch
    SELinux is a mandatory access control (MAC) system available in Linux kernels as of version 2.6. Of the Linux Security Modules available, it is the most comprehensive and well tested, and is founded on 20 years of MAC research. SELinux combines a type-enforcement server with either multi-level security or an optional multi-category policy, and a notion of role-based access control. See the Resources section later in this article for links to more information about these topics. Most people who have used SELinux have done so by using an SELinux-ready distribution such as Fedora, Red Hat Enterprise Linux (RHEL), Debian, or hardened Gentoo. These enable SELinux in the kernel, offer a customizable security policy, and patch a great number of user-land libraries and utilities to make them SELinux aware. (Editorial comment: EnGarde Secure Linux is an SELinux-ready distibution)

  • Users of SELinux Now Have A Choice On Security
    The release of a new open-source security package has sparked debate over how many Mandatory Access Control applications Linux really needs, and if more than one would just dilute volunteer efforts. Novell Inc. of Provo, Utah, recently released the source code for its recently acquired Linux security application, AppArmor. It also set up a project site in hopes of attracting outside developers to further refine the program.

  • Security Wars: Novell SELinux Killer Rattles Red Hat
    Novell Inc. of Provo, Utah, has released the source code for its recently acquired open-source Linux security application, AppArmor, and has also set up a project site in hopes of attracting outside developers to further refine the program. The release of the software has sparked debate in the open-source community, however.

  • Demystifying Security Enhanced Linux
    In this paper I will try to explain the philosophy behind the Security Enhanced Linux (SE Linux). I will however try to explain the concept with an example but to keep the length readable I will restrain myself to go into much of implementation details for e.g. commands and similar stuff.

  • Hacks From Pax: SELinux Policy Development
    Hi, and welcome to the final entry in my series of articles on SELinux. My last three articles have provided an overview and history of SELinux, discussed how SELinux makes access decisions, and explained how to administer an SELinux system. Today we'll build on the SELinux knowledge we've gained and learn how to perform basic customization of our system's security policy.

  • Hacks From Pax: SELinux Administration
    Hi, and welcome to the third in a series of articles on Security Enhanced Linux. My first SELinux article detailed the background of SELinux, while my second article in the series discussed how SELinux makes access decisions. This week, I'll talk about how an SELinux system differs from a standard Linux system in terms of administration. Most of what you already know about Linux system administration will still apply to an SELinux system, but there are some additions and changes that are critical to understand when using SELinux.

  • Hacks From Pax: SELinux And Access Decisions
    Hi, and welcome to my second of a series of articles on Security Enhanced Linux. My previous article detailed the background of SELinux and explained what makes SELinux such a revolutionary advance in systems security. This week, we'll be discussing how SELinux security contexts work and how policy decisions are made by SELinux.

  • Hacks From Pax: Security Enhanced Linux and Mandatory Access Control
    Security Enhanced Linux, or SELinux, is an exciting security project that is reaching maturity and poised to revolutionize the way Linux security administration is performed. Originally developed by the National Security Agency and released as an open source project, but now breaking into the mainstream in Red Hat, Fedora, Gentoo, and the new release of EnGarde Secure Linux 3.0, it incorporates Mandatory Access Control into a base Linux system. This is a revolutionary advance, but is also very different from the standard Linux security model. This week in Hacks From Pax, I'll provide a basic introduction to the philosophy behind SELinux, and explain how it can add a powerful layer of security to your Linux system.

  • Linux Labs International consolidates SELinux with Bproc
    Linux Labs International, Inc. ( LLII ), the world leader in Linux-based clustered supercomputer engineering, announced today a key milestone for security in supercomputing technology. With today's release of Nimbus 4.0, its out-of-the-box Linux cluster distribution, the leading Single System Image cluster architecture ( bproc ) is now seamlessly integrated with SELinux, the Security Enhanced Linux platform ( SELinux ).

  • Will SELinux Become More Widely Adopted?
    "The National Security Agency built a version of Linux with more security tools that its technologists believe could help make the country's computing infrastructure less vulnerable. They've won over the Linux developer community with the changes. But success depends on its adoption by U.S. companies and government agencies, something that remains very much in doubt. (ed: not to mention adoption by Joe User, who is depending on his vendor to make this thing workable)

  • Realistic SELinux
    SElinux is an impressively designed but notoriously hard-to-configure set of kernel hooks that enforce Orange Book-style security on Linux. Full support for SELinux takes effort, but when I first heard about Fedora's new targeted policies for SELinux, I was willing to tell the Red Hat folks "thanks, but no thanks." A conversation with their Dan Walsh changed my mind.

  • SELinux: Playing with fire
    One of the much-talked-about features in Fedora Core 3 (FC3) is Security-Enhanced Linux, which some people believe will make Linux a truly military-grade secure operating system. But SELinux is available to secure many other distributions as well.

  • Linux in Government: Security Enhanced Linux - The Future is Now
    If a must-have, must-know innovation exists for Linux's future viability, you might place all bets on Security Enhanced Linux. Vastly misunderstood and underrated, SELinux provides a marketing differentiator that could carry Linux deep into infrastructures that so far have shown lukewarm acceptance of the open-source operating system. SELinux transforms standard Linux from a cost-effective and secure operating system into a behemoth.

  • SELinux Boosts Server Security
    SELinux enforces mandatory access control policies, which limit user and application privileges to the minimum required to do the job. In contrast, most operating systems have DAC (discretionary access control) schemes in which a process has access to everything available to the user who launched it. . . .

  • Security Enhanced Linux
    Operating system security is (or at least should be) of critical importance to us all. However, the varying levels of security required differ for each systems administrator. . . .

  • Fedora Announces new SELinux Mailing List
    This is to announce the availablity of a new Fedora mailing list for SELinux-specific discussion. The list is for users and developers posting bug reports, avc messages, support questions & answers, patches etc. For subscription details, see :http://www.redhat.com/mailman/listinfo/fedora-selinux-list . . .

  • SELinux Demonstration!
    The aim of this is to demonstrate that all necessary security can be provided by SE Linux without any Unix permissions (however it is still recommended that you use Unix permissions as well for real servers). Also it gives you a chance to login to a SE machine and see what it's like. . . .

  • Hardened Gentoo's SELinux Demo Machine
    We at Gentoo have put up an SELinux demo machine to show the power of SELinux, the url http://selinux.dev.gentoo.org/ has root login information and http://www.gentoo.org/proj/en/hardened is the project page. Check out both URLs to find out additional . . .

  • SysAdmin: SELinux
    Security Enhanced Linux (SELinux) is an extension to the standard Linux kernel that has been designed to enforce strict access controls. SELinux lets you confine processes to the minimum amount of privilege they require. In this article, I will cover the ideas behind SELinux and show how to install, configure, and manage an SELinux system.. . .

  • SELinux: Message from Secure Computing
    Secure Computing has reviewed the concerns expressed by the open source community about SELinux and certain Secure Computing patents. We understand that considerable effort has been invested in SELinux, with the expectation that SELinux would be available for everyone's use. . . .

  • SELinux aims for security certification and credibility among cautious IT purchasers
    The Cyberspace Policy Institute at The George Washington University is launching an effort to get international security ratings for the U.S. National Security Agency-driven Security Enhanced Linux project, a move that organizers hope will make Linux more attractive to cautious technology purchasers, including government agencies.. . .

  • New release of the LSM-based SELinux prototype
    The SELinux web site including the mail list archive has been updated. The site includes a new release of the LSM-based SELinux prototype. This release contains many bug fixes and improvements to both LSM and SELinux and is based on the . . .

  • NSA Releases Updated SELinux
    The new SELinux prototype that uses the Linux Security Modules (LSM) kernel patch is now available for download. In this release, we are using a kernel patch based on the lsm-2001_08_16 patch against kernel 2.4.9. . . .