Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I suspect that SElinux is backdoor and I want to stop it from working on my system. I want to stop it and delete it from the system also if that is possible.
First, you can stop SELinux from working by misconfiguring it. That does nothing to disable any backdoor, though.
Then you can stop SELinux from doing anything by configuring it at runtime. If you run setenforce 0, SELinux stops enforcing security restrictions. It's still active, though. All you've done is potentially make your system less secure by removing security restrictions.
If you don't want SELinux to apply at all, you can turn it off at boot time with the kernel parameter selinux=0. This way SELinux won't be making any decisions. You lose any security benefit it may bring of course. And if there's a backdoor, you have no way to know that it isn't still active. The code is still present, after all.
Ok then, you need to remove the code from the kernel. So recompile your kernel, with the configuration option CONFIG_SECURITY_SELINUX not set. Reboot, and now the SELinux code isn't running anymore. Victory?
Ha! No: how do you know that the backdoor is in the code that's controlled by this configuration option? If I was going to hide a backdoor, I'd make sure that it would be part of code that everybody uses.
If you want to be sure to be rid of whatever backdoor may have been introduced as part of SELinux, you need to go back to a kernel version that dates from before SELinux was introduced, and carefully evaluate all the commits that were made to the kernel since then and decide whether they are backdoor-free. Once you've done that, you'll have a backdoor-free system. I mean, a backdoor-free kernel. I mean, a kernel without this particular backdoor that you posit.
Psych! No, the backdoor may still be there. What if there was a backdoor in the kernel that affected the compiler, so that when you compiled the kernel, it injected the backdoor into the kernel even if the source of the backdoor wasn't present? This would be a self-sustaining backdoor: compile with a backdoored compiler or under a backdoored kernel, and the resulting kernel is still backdoored. Sounds far-fetched? You think no one could do that? Sorry, but it has been done. Do read Ken Thompson's Turing Award lecture, “Reflections on Trusting Trust”.
Ok, ok. You can't trust the software. So you'll need to write your own software, and your own compiler, and be sure not to use the current, possibly suspect compiler or kernel to compile your own backdoor-free system. Write machine code directly, I guess.
Ah, but beware! A malicious operating system (or malicious software with kernel-level access, for that matter) could have injected a backdoor into your firmware. So if you don't trust your current kernel, you can't trust your BIOS, either.
No, no, this won't go. You'll need to make your own hardware. Good luck!
I don't think you'll be able to remove SELinux. The best you can hope to do is disable it (which I discuss below in later sections).
To remove it you'd attempt to remove the package libselinux, however attempting to do so leads to this:
$ sudo yum remove libselinux
...
--> Finished Dependency Resolution
Error: Trying to remove "kernel", which is protected
Error: Trying to remove "yum", which is protected
The problem is that SELinux is a core dependency that many packages rely on, so it's essentially impossible to remove it.
You can use the commands getenforce and setenforce to see the current SELinux mode as well as change it.
$ setenforce
usage: setenforce [ Enforcing | Permissive | 1 | 0 ]
$ setenforce 0
$ getenforce
Disabled
These only change it for the current session. If you were to reboot then SELinux would come back up upon reboot.
To make the changes permanent, you can edit this file on Redhat based distros, /etc/sysconfig/selinux.
$ cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
NOTE: The directory, /etc/sysconfig/selinux is actually a link to this location:
$ pwd
/etc/sysconfig
$ ls -l selinux
lrwxrwxrwx. 1 root root 17 Dec 18 2010 selinux -> ../selinux/config
Hardly. SELinux is security product that provides protection between applications and the files on your filesystem. This protection makes use of contexts that are written into the filesystem via extended attributes (xattr).
These attributes can be used to control which applications (processes) can touch which directories and files on disk. It can also control the nature of the applications access to these locations.
If you had a directory, /home/userX, and you were running the Apache web server on your system, then there's technically no reason that this process would require access to the /home directories, so SELinux could disallow this process access to this particular location based on the contexts (rules) that were laid out on the disk.
I would recommend not uninstalling it. If it's annoying you can put it into either Permissive mode or Disabled. I often disable it on systems where it gets in the way, but it's best to try and identify what these accesses are and explicitly allow them, rather than disable it all together.
sed, --follow-symlinks is needed for /etc/sysconfig/selinux so that symlink is not breaked afterwards.
Dec 4, 2013 at 9:41
As SELinux is included in your Linux kernel, disabling it and uninstalling the userland programs is not enough. You need also to rebuild the kernel to get really rid of it. But in general I see no reason why there should be backdoors in SELinux particularly and not in other components (software or hardware).
Removing it makes your system more vulnerable against other attacks. If you have security concerns and do not like SELinux, you might be interested in others security frameworks like e.g. AppAmor or grsecurity (which seems no longer be actively developed). See for example What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?.
I suspect that SElinux is backdoor and I want to stop it from working on my system.
If you suspect that SElinux is a back door, then you have a more serious problem on your hands than just disabling its functionality.
SElinux is in fact a core component in Linux itself; it's part of the upstream "mainline" tree, meaning that it has been integrated into the primary Linux source code for the past 10 years. If it is, indeed, a backdoor, then it's a backdoor that was put there by Linus Torvalds himself, who personally approved its inclusion in 2003.
And if, therefore, Torvalds and all the other core Linux maintainers are willing to include backdoor software in Linux, you can't trust any of the code they produce.
So, the only way to solve the problem you've proposed is to switch to an alternate OS entirely, BSD for example.
You can also disable SELinux at boot time by passing the kernel parameter selinux=0 (see your bootloader configuration to do that).
See the official documentation about this.
