Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?
closed as too broad by Jeff Schaller♦, Michael Homer, jimmij, Thomas, Romeo Ninov Feb 3 at 10:39
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
SELinux is a form of mandatory access control, where a set of labels are used to control what processes can or cannot do. The default access control method on Linux involving
ugo permissions is discretionary - it leaves it to the user's discretion to actually figure out what permissions should go where. A 'problem' with using SELinux's mandatory access control is that applications can sometimes refuse to work as you want them to, for apparently mysterious reasons.
Let's take the
rsyslog daemon as an example. The directory and files under
/var/log have the correct SELinux labels to work with
rsyslog. However, if you try to define a log file elsewhere on the system, such as
rsyslog will not be able to write to it because of the wrong SELinux contexts on that file. Because the access control is mandatory, this will happen even if you are setting
777 permissions on the new log file. In this specific case, the SELinux contexts may be set on the new log file using
chcon. But wait, those contexts would be lost on the next relabelling of the filesystem. So what you really need is
As I've tried to illustrate with the above example, SELinux has a strong learning curve. Even after you understand the basics of how it works, you still have to work with a large number of commands (
audit2allow) to achieve the intended result. Even then, the documentation can sometimes leave you confused about where you're going wrong.
Given the challenges with actually using SELinux, most people just find disabling it to be a more convenient option. In fact, the highest voted question under the SELinux tag here on U&L is about disabling SELinux.
One more thing to note is that distributions related to Red Hat ship with SELinux enabled (Fedora, RHEL and its derivatives). The SELinux policies that ship with these systems have gotten good enough that a lot of people would not typically notice SELinux running on their system.
Yes; Red Hat Enterprise Linux enables it by default, for one:
Enforcing mode is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system.