NewUsers
This is a resource for new users, it explains in very broad terms what SELinux does, how to get it and so on.
Contents
What does SELinux do?
SELinux controls access between applications and resources. By using a mandatory security policy SELinux enforces the security goals of the system regardless of whether applications misbehave or users act carelessly. SELinux is capable of enforcing a wide range of security goals, from simply sandboxing applications to locking down network facing daemons and restricting users to only the resources they need to work.
How do I know if SELinux is on?
If you use Red Hat Enterprise Linux or Fedora it is enabled by default. To see whether it is actively enforcing the policy you can run getenforce:
[root@localhost ~]# getenforce Enforcing
If it says Enforcing (as above) your system is being protected by SELinux. If it says permissive SELinux is enabled but is only logging failed accesses, not denying them. If it says Disabled then SELinux is not enabled on your system.
How do I get it?
SELinux isn't a distribution by itself but a security enhancement to Linux that can be enabled by your distribution or vendor (or yourself if you are very motivated).
Distribution | How to get it |
---|---|
Red Hat Enterprise Linux (4+) | Default |
Fedora (2+) | Default |
Ubuntu | Hardened Ubuntu |
Debian | add-on |
Gentoo | Hardened Gentoo |
Why do I have it?
Your distribution or vendor may have chosen to enable SELinux by default. They are doing this because they want added security protections on the versions of Linux they ship. A huge amount of effort has gone in to creating security policies that protect your system from intrusions while at the same time allowing users to behave the way they normally do. Leaving SELinux enabled on these systems is a good idea because it can protect you from zero-day and known vulnerabilities while balancing your need to use your system the way you need to.
Where can I find help?
There are several mailing lists and IRC channels depending on what distribution you are running and what you need help with. See the Mailing lists and IRC channels page for a full list.
This site has additional documentation that can help you use SELinux. You can start with the administrators and users page.
The SELinux Notebook
Some of the sections from The SELinux Notebook - 4th Edition are available on this site. There is also a supporting source tarball (notebook-source-4.0.tar.gz) available to download that demonstrates some of the SELinux capabilities.
Notebook Sections
The major sections are:
- SELinux Overview
- Core Components
- Mandatory Access Control (MAC)
- SELinux Users
- Role-Based Access Control (RBAC)
- Type Enforcement (TE)
- Security Context
- Subjects
- Objects
- Computing Security Contexts
- Computing Access Decisions
- Domain and Object Transitions
- Multi-Level Security and Multi-Category Security
- Types of SELinux Policy
- Permissive and Enforcing Modes
- Auditing Events
- Polyinstantiation Support
- PAM Login Process
- Linux Security Module and SELinux
- SELinux Userspace Libraries
- SELinux Networking Support
- SELinux Virtual Machine Support
- SELinux X-Windows Support
- Sandbox Services
- SE-PostgreSQL Support
- Apache-Plus Support
- SELinux Configuration Files
- The SELinux Policy Languages
- CIL Policy Language
- Kernel Policy Language
- Policy Configuration Statements
- Default Rules
- User Statements
- Role Statements
- Type Statements
- Bounds Rules
- Access Vector Rules
- Extended Permission Access Vector Rules
- Object Class and Permission Statements
- Conditional Policy Statements
- Constraint Statements
- MLS Statements
- Security ID (SID) Statement
- File System Labeling Statements
- Network Labeling Statements
- Modular Policy Support Statements
- XEN Statements
- The Reference Policy
- Implementing SELinux-aware Applications
- SE for Android
- libselinux API Summary
- Object Classes and Permissions
See this page translation in French.