filmov
tv
What is SELinux? | How to enable/disable SELinux (Security Enhanced Linux) #security
Показать описание
Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM).
SELinux was released to the open source community in 2000, and was integrated into the upstream Linux kernel in 2003.
How does SELinux work?
SELinux defines access controls for the applications, processes, and files on a system. It uses security policies, which are a set of rules that tell SELinux what can or can’t be accessed, to enforce the access allowed by a policy.
When an application or process, known as a subject, makes a request to access an object, like a file, SELinux checks with an access vector cache (AVC), where permissions are cached for subjects and objects.
If SELinux is unable to make a decision about access based on the cached permissions, it sends the request to the security server. The security server checks for the security context of the app or process and the file. Security context is applied from the SELinux policy database. Permission is then granted or denied.
How to configure SELinux
There are a number of ways that you can configure SELinux to protect your system. The most common are targeted policy or multi-level security (MLS).
Targeted policy is the default option and covers a range of processes, tasks, and services. MLS can be very complicated and is typically only used by government organizations.
You can tell what your system is supposed to be running at by looking at the /etc/sysconfig/selinux file. The file will have a section that shows you whether SELinux is in permissive mode, enforcing mode, or disabled, and which policy is supposed to be loaded.
SELinux labeling and type enforcement
Type enforcement and labeling are the most important concepts for SELinux.
SELinux works as a labeling system, which means that all of the files, processes, and ports in a system have an SELinux label associated with them. Labels are a logical way of grouping things together. The kernel manages the labels during boot.
Labels are in the format user:role:type:level (level is optional). User, role, and level are used in more advanced implementations of SELinux, like with MLS. Label type is the most important for targeted policy.
SELinux uses type enforcement to enforce a policy that is defined on the system. Type enforcement is the part of an SELinux policy that defines whether a process running with a certain type can access a file labeled with a certain type.
Enabling SELinux
If SELinux has been disabled in your environment, you can enable SElinux by editing /etc/selinux/config and setting SELINUX=permissive. Since SELinux was not currently enabled, you don’t want to set it to enforcing right away because the system will likely have things mislabeled that can keep the system from booting.
You can force the system to automatically relabel the filesystem by creating an empty file named .autorelabel in the root directory and then rebooting. If the system has too many errors, you should reboot while in permissive mode in order for the boot to succeed. After everything has been relabeled, set SELinux to enforcing with /etc/selinux/config and reboot, or run setenforce 1.
If a sysadmin is less familiar with the command line, there are graphic tools available that can be used to manage SELinux.
SELinux provides an additional layer of security for your system that is built into Linux distributions. It should remain on so that it can protect your system if it is ever compromised.
Don't forget to like, share, and subscribe for more tutorials on Linux, virtualization, and system administration!
🕒 Timestamps:
00:00 - What is SELinux ?
00:53 - How to Disable Selinux?
05:30 - How to Enable Selinux?
🔗 Connects--------------------------
🔗 Follow Us on Social Media:
Get updates or reach out to Get updates on our Social Media Profiles!
#selinux #linux #security #disabled #securityproducts #securitybreach #linuxsecurity #how #enable #disabled #configuración #configuration #linuxkernel #tutorial #tutorials
SELinux was released to the open source community in 2000, and was integrated into the upstream Linux kernel in 2003.
How does SELinux work?
SELinux defines access controls for the applications, processes, and files on a system. It uses security policies, which are a set of rules that tell SELinux what can or can’t be accessed, to enforce the access allowed by a policy.
When an application or process, known as a subject, makes a request to access an object, like a file, SELinux checks with an access vector cache (AVC), where permissions are cached for subjects and objects.
If SELinux is unable to make a decision about access based on the cached permissions, it sends the request to the security server. The security server checks for the security context of the app or process and the file. Security context is applied from the SELinux policy database. Permission is then granted or denied.
How to configure SELinux
There are a number of ways that you can configure SELinux to protect your system. The most common are targeted policy or multi-level security (MLS).
Targeted policy is the default option and covers a range of processes, tasks, and services. MLS can be very complicated and is typically only used by government organizations.
You can tell what your system is supposed to be running at by looking at the /etc/sysconfig/selinux file. The file will have a section that shows you whether SELinux is in permissive mode, enforcing mode, or disabled, and which policy is supposed to be loaded.
SELinux labeling and type enforcement
Type enforcement and labeling are the most important concepts for SELinux.
SELinux works as a labeling system, which means that all of the files, processes, and ports in a system have an SELinux label associated with them. Labels are a logical way of grouping things together. The kernel manages the labels during boot.
Labels are in the format user:role:type:level (level is optional). User, role, and level are used in more advanced implementations of SELinux, like with MLS. Label type is the most important for targeted policy.
SELinux uses type enforcement to enforce a policy that is defined on the system. Type enforcement is the part of an SELinux policy that defines whether a process running with a certain type can access a file labeled with a certain type.
Enabling SELinux
If SELinux has been disabled in your environment, you can enable SElinux by editing /etc/selinux/config and setting SELINUX=permissive. Since SELinux was not currently enabled, you don’t want to set it to enforcing right away because the system will likely have things mislabeled that can keep the system from booting.
You can force the system to automatically relabel the filesystem by creating an empty file named .autorelabel in the root directory and then rebooting. If the system has too many errors, you should reboot while in permissive mode in order for the boot to succeed. After everything has been relabeled, set SELinux to enforcing with /etc/selinux/config and reboot, or run setenforce 1.
If a sysadmin is less familiar with the command line, there are graphic tools available that can be used to manage SELinux.
SELinux provides an additional layer of security for your system that is built into Linux distributions. It should remain on so that it can protect your system if it is ever compromised.
Don't forget to like, share, and subscribe for more tutorials on Linux, virtualization, and system administration!
🕒 Timestamps:
00:00 - What is SELinux ?
00:53 - How to Disable Selinux?
05:30 - How to Enable Selinux?
🔗 Connects--------------------------
🔗 Follow Us on Social Media:
Get updates or reach out to Get updates on our Social Media Profiles!
#selinux #linux #security #disabled #securityproducts #securitybreach #linuxsecurity #how #enable #disabled #configuración #configuration #linuxkernel #tutorial #tutorials
0:04:52
0:05:28
0:21:56
0:09:43
0:04:10
0:12:17
0:31:23
0:43:58
0:04:21
0:22:28
0:09:11
0:15:16
0:09:29
0:00:57
0:00:45
0:05:35
0:31:41
0:11:31
0:07:35
0:36:53
0:38:09
0:05:53
0:22:45
0:39:43