From Fedora Project Wiki

No edit summary
No edit summary
Line 33: Line 33:
<pre>
<pre>


type=AVC msg=audit(1214965667.121:635): avc:  denied  { unix_read unix_write } for  pid=15524 comm="npviewer.bin" key=59918130 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s
type=AVC msg=audit(1214965667.121:635): avc:  denied  { unix_read unix_write } for  pid=15524 comm="npviewer.bin"  
key=59918130 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023  
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s


</pre>
</pre>

Revision as of 04:25, 2 July 2008

Frequently Asked Questions

Note.png
The current draft is the wiki is work in progress. Do not rely on it currently. Older versions of the FAQ is available in the references section .

What is SELinux?

SE(Security Enhanced) Linux is a security feature in the Linux and enabled by default in Fedora that provides more fine grained access control compared to traditional file permissions. A centralized policy determines which software can access what resources. For example, network services can be confined to a particular port and Apache web server can be restricted to be able to connect to only 80 by default.

Who developed SELinux?

NSA (National Security Agency) developed SELinux initially. It has partnered with Red Hat to continue development and carry out integration of SELinux into Fedora and Red Hat Enterprise Linux. It is not specific to Red Hat however and other Linux distributions and other operating systems have adopted SELinux and similar frameworks.

Is it a firewall?

Though often confused with one, SELinux is not a firewall. A firewall controls the flow of traffic to and from a computer to the network. SELinux can confine access of programs within a computer and hence can be conceptually thought of a internal firewall between programs. Security works best when multiple layers are used and SELinux is complimentary to a firewall and other security features used in Fedora.

Is it useful on a desktop?

Yes. SELinux policies in Fedora were initially focused on network facing services. However several dozens of desktop software including Firefox, HAL, D-Bus etc are protected by default using SELinux policies in current releases of Fedora.

How do I find out if SELinux is enabled on my system?

Run the sestatus command to find out the current status of SELinux. SELinux can be in three different modes

Enabled: SELinux is enabled and SELinux policy is enforced Disabled: SELinux is disabled and has no effect on your system Permissive: SELinux is enabled but but merely logs warnings instead of enforcing access. This mode is useful for troubleshooting.

How do I find out whether SELinux is denying access for any software?

When SELinux prevents any software from accessing a particular resource, for example when Firefox is denied access to /etc/shadow, it generates a message and logs it in /var/log/audit/audit.log or /var/log/messages if audit service is disabled. If the log contains "avc:denied" that means it is a SELinux policy denial. Note that you would need administrator privileges (root access) on your system to be able to read this log file. An example denial would look like


type=AVC msg=audit(1214965667.121:635): avc:  denied  { unix_read unix_write } for  pid=15524 comm="npviewer.bin" 
key=59918130 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s


What is mandatory access control ?

SELinux (Security-Enhanced Linux) in Fedora is an implementation of mandatory access control in the Linux kernel using the Linux Security Modules (LSM) framework. Discretionary access control (DAC) is standard Linux security, and it provides no protection from broken software or malware running as a normal user or root. Users can grant risky levels of access to files they own. Mandatory access control (MAC) provides full control over all interactions of software. Administratively defined policy closely controls user and process interactions with the system, and can provide protection from broken software or malware running as any user.

In a DAC model, file and resource decisions are based solely on user identity and ownership of the objects. Each user and program run by that user has complete discretion over the user's objects. Malicious or flawed software can do anything with the files and resources it controls through the user that started the process. If the user is the super-user or the application is setuid or setgid to root, the process can have root level control over the entire file system.

A MAC system does not suffer from these problems. First, you can administratively define a security policy over all processes and objects. Second, you control all processes and objects, in the case of SELinux through the kernel. Third, decisions are based on all the security relevant information available, and not just authenticated user identity.

MAC under SELinux allows you to provide granular permissions for all subjects (users, programs, processes) and objects (files, devices). In practice, think of subjects as processes, and objects as the target of a process operation. You can safely grant a process only the permissions it needs to perform its function, and no more.

The SELinux implementation uses role-based access control (RBAC), which provides abstracted user-level control based on roles, and Type Enforcement® (TE). TE uses a table, or matrix to handle access controls, enforcing policy rules based on the types of processes and objects. Process types are called domains, and a cross-reference on the matrix of the process's domain and the object's type defines their interaction. This system provides extremely granular control for actors in a Linux system.

What is the performance impact of SELinux?

Previous FAQs