What is SELinux and what are the advantages of using it? Why does Linux need another layer of protection?
-
1Very broad question, why don't you search a bit on the Internet first.– KrackoutAug 23, 2020 at 15:48
-
@Krackout: I've searched but I don't get it. Most of videos start introducing the commands directly without explaining why it is needed? is it something to avoid viruses or whatever?– adhrar_nmatrousAug 23, 2020 at 16:38
-
SELinux excels at protecting against zero-day attacks. I wrote a bit about this on our sister site Server Fault.– Michael HamptonAug 24, 2020 at 0:48
1 Answer
This question is rather generic and broad for Unix.SE - but I'll give a broad/general response. If you want to know more specifics, ask specifically about those.
SELinux helps protect you against bugs in software. You need it because your software is millions of lines of code and, no matter how good the software engineers are, they're going to contain bugs. SELinux operates as a bit of a middle man and makes sure that the software doesn't run as 'you' and thus doesn't have all of your permissions.
Allow me to quote...
In short because SELinux can help protect you from bugs in applications. Most people treat applications as user surrogates (e.g., "I go to google.com" not "I tell my browser to go to google.com and it does so on my behalf"). However applications, especially the desktop applications we all use, come in at millions of lines of code. Without knowing what those millions of lines of code do there is no way to know if an application will really do what you tell it or if it becomes malicious because of vulnerabilities. With SELinux you can treat the applications you run differently from yourself thereby limiting what an exploited application can do.
Source: SELinux Wiki
Note: That link is actually pretty thorough and will answer other general questions you may have.
-
Thanks. But why it is not used in Ubuntu? is it a distro specific or something standard Aug 23, 2020 at 16:37
-
1It's distro-specific. Ubuntu uses AppArmor. Open your terminal and enter
sudo apparmor_status
, if you're curious. There are a number of choices, including choosing nothing. At the end of the day, they're just tools and the onus of keeping your system secured is yours.– KGIIIAug 23, 2020 at 16:48 -
Can I use that for example to prevent rm from removing anything from the home directory? Aug 23, 2020 at 16:51
-
Not that I'm aware of. If you have new questions, post those as new questions. Unix.SE is used for a very specific format.– KGIIIAug 23, 2020 at 16:55