Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier it felt like when I discovered SELinux which I had not priorly heard of. After doing some research it seemed as though most people were of the opinion that you should just disable it and not deal with the hassle. Personally if it really does add more security I'm not opposed to dealing with the headaches of learning how to appropriately set it up. Eventually I plan on opening my network up so that this pc can be access remotely but I don't want to do that until such time as I'm confident that its secure (more or less... lol). If you have set it up and gotten it functioning correctly do you feel that it was worth the time and hassle? Is it really more secure? If you have opted out of using it was that decision founded on any research worth considering in my situation as well?

share|improve this question
    
please bear in mind that a good security mindset is that no security should cost more to implement than the value of what it's protecting. Thus if your time is worth $50 an hour, and it will take you 8 hours to implement SELinux, but it would only take 1 hour average to repair, and maybe $50 to replace a device... (thinking soho router) it is not worth the cost of implementing SELinux. However if your data is irreplaceable, and not a compromise would cost millions but it would take 100k to implement... it's worth it. –  xenoterracide Mar 15 '11 at 22:48
add comment

2 Answers 2

up vote 9 down vote accepted

SELinux enhanced local security by improving the isolation between processes and providing more fine-grained security policies.

For multi-user machines, this can be useful because of the more flexible policies, and it raises more barriers between users so it adds protection against malicious local users.

For servers, SELinux can reduce the impact of a security vulnerability in a server. Where the attacker might be able to gain local user or root privileges, SELinux might only allow him to disable one particular service.

For typical home use, where you'll be the only user and you'll want to be able to everything remotely once authenticated, you won't gain any security from SELinux.

share|improve this answer
    
but if I plan on making it a server that others can log into remotely with their own credentials I could still potentially benefit from a correct setup? That's not in the immediate plans but could eventually be... –  Kenneth Mar 12 '11 at 22:46
    
@Kenneth: The more services you run, and the more users you have, the more security SELinux can bring. At the extreme of a single-user machine with only ssh, SELinux is no use. Beyond that, yes, it's useful, but it's a large investment. Always keep in mind that a poorly understood security tool is a liability, because you might get a false sense of security if you get overconfident about its abilities, and there's a risk that you will misconfigure it and introduce a security hole. –  Gilles Mar 12 '11 at 22:51
    
@Gilles perhaps then I will disable it for the time being as I don't plan on making my web server available for public viewing at this time. Then I'll just spend what time I have available studying it for later use... –  Kenneth Mar 12 '11 at 22:58
1  
@Kenneth - the upside of learning it now, is that if you do need it in anger you will already have learned a lot of its foibles...and it has a few:-) –  Rory Alsop Mar 13 '11 at 0:28
1  
SELinux can have strong benefits for home use. I'll elaborate more later. –  mattdm Mar 13 '11 at 3:09
show 1 more comment

The problem with SELinux for non-IT people like myself is that it does not identify itself as the cause of permissions problems - in other words the errors you get are not distinguishable from other more common errors and SELinux is the last place you will look or for which you will be able to get answers publicly. This is the worst type of feature IMO.

http://jermdemo.blogspot.com/2011/10/selinux-for-enhanced-headaches.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.