1

Almost all tutorial and most systems i have seen seem to disable selinux. Are there actual implementation of selinux security in real world ?

3
  • 1
    yes, android is making heavy use of selinux. And please no "no true Scotsman"; android is a real linux system, and a multi-billion install base should be "real world" enough for anybody.
    – user313992
    Commented Feb 2, 2019 at 16:42
  • 2
    The tutorial authors must be naive or lazy. Yes, of course: SELinux was developed by the NSA for real reasons, and those reasons still exist. Thus, SELinux is absolutely in use in the real world solving real-world problems. Do not disable SELinux; learn to use it instead! :) Commented Feb 2, 2019 at 21:15
  • 1
    There are tons of real world examples of selinux, your question shows little to no effort on your part. The tutorials advising ti disable selinux are poorly written, lead to use and debug selinux
    – Panther
    Commented Feb 3, 2019 at 3:11

2 Answers 2

4

SELinux is a form of mandatory access control, where a set of labels are used to control what processes can or cannot do. The default access control method on Linux involving ugo permissions is discretionary - it leaves it to the user's discretion to actually figure out what permissions should go where. A 'problem' with using SELinux's mandatory access control is that applications can sometimes refuse to work as you want them to, for apparently mysterious reasons.

Let's take the rsyslog daemon as an example. The directory and files under /var/log have the correct SELinux labels to work with rsyslog. However, if you try to define a log file elsewhere on the system, such as /opt, rsyslog will not be able to write to it because of the wrong SELinux contexts on that file. Because the access control is mandatory, this will happen even if you are setting 777 permissions on the new log file. In this specific case, the SELinux contexts may be set on the new log file using chcon. But wait, those contexts would be lost on the next relabelling of the filesystem. So what you really need is semanage fcontext.

As I've tried to illustrate with the above example, SELinux has a strong learning curve. Even after you understand the basics of how it works, you still have to work with a large number of commands (semanage, sestatus, sealert, chcon, restorecon, audit2allow) to achieve the intended result. Even then, the documentation can sometimes leave you confused about where you're going wrong.

Given the challenges with actually using SELinux, most people just find disabling it to be a more convenient option. In fact, the highest voted question under the SELinux tag here on U&L is about disabling SELinux.

One more thing to note is that distributions related to Red Hat ship with SELinux enabled (Fedora, RHEL and its derivatives). The SELinux policies that ship with these systems have gotten good enough that a lot of people would not typically notice SELinux running on their system.

4

Yes; Red Hat Enterprise Linux enables it by default, for one:

Enforcing mode is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system.

3
  • I understand its enabled by default, my question is do we actually use it ?
    – Atul
    Commented Feb 2, 2019 at 13:29
  • Most of time, i see it's being disabled. It may be a bad practice or is it really that hard to use the system with selinux in real world
    – Atul
    Commented Feb 2, 2019 at 13:30
  • 2
    Obiligatory stopdisablingselinux.com
    – Jeff Schaller
    Commented Feb 2, 2019 at 13:41

Not the answer you're looking for? Browse other questions tagged .