I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier it felt like when I discovered SELinux which I had not previously heard of. After doing some research it seemed as though most people were of the opinion that you should just disable it and not deal with the hassle. Personally if it really does add more security I'm not opposed to dealing with the headaches of learning how to appropriately set it up. Eventually I plan on opening my network up so that this pc can be access remotely but I don't want to do that until such time as I'm confident that its secure (more or less). If you have set it up and gotten it functioning correctly do you feel that it was worth the time and hassle? Is it really more secure? If you have opted out of using it was that decision founded on any research worth considering in my situation as well?
-
2please bear in mind that a good security mindset is that no security should cost more to implement than the value of what it's protecting. Thus if your time is worth $50 an hour, and it will take you 8 hours to implement SELinux, but it would only take 1 hour average to repair, and maybe $50 to replace a device... (thinking soho router) it is not worth the cost of implementing SELinux. However if your data is irreplaceable, and not a compromise would cost millions but it would take 100k to implement... it's worth it.– xenoterracideMar 15, 2011 at 22:48
2 Answers
SELinux enhanced local security by improving the isolation between processes and providing more fine-grained security policies.
For multi-user machines, this can be useful because of the more flexible policies, and it raises more barriers between users so it adds protection against malicious local users.
For servers, SELinux can reduce the impact of a security vulnerability in a server. Where the attacker might be able to gain local user or root privileges, SELinux might only allow him to disable one particular service.
For typical home use, where you'll be the only user and you'll want to be able to everything remotely once authenticated, you won't gain any security from SELinux.
-
but if I plan on making it a server that others can log into remotely with their own credentials I could still potentially benefit from a correct setup? That's not in the immediate plans but could eventually be...– KennethMar 12, 2011 at 22:46
-
@Kenneth: The more services you run, and the more users you have, the more security SELinux can bring. At the extreme of a single-user machine with only ssh, SELinux is no use. Beyond that, yes, it's useful, but it's a large investment. Always keep in mind that a poorly understood security tool is a liability, because you might get a false sense of security if you get overconfident about its abilities, and there's a risk that you will misconfigure it and introduce a security hole. Mar 12, 2011 at 22:51
-
1@Kenneth - the upside of learning it now, is that if you do need it in anger you will already have learned a lot of its foibles...and it has a few:-) Mar 13, 2011 at 0:28
-
1SELinux can have strong benefits for home use. I'll elaborate more later.– mattdmMar 13, 2011 at 3:09
-
1SELinux can do brilliant stuff, even on a single user machine, like sandboxing applications.– wzzrdApr 7, 2011 at 21:18
The problem with SELinux for non-IT people like myself is that it does not identify itself as the cause of permissions problems - in other words the errors you get are not distinguishable from other more common errors and SELinux is the last place you will look or for which you will be able to get answers publicly. This is the worst type of feature IMO.
http://jermdemo.blogspot.com/2011/10/selinux-for-enhanced-headaches.html
