CHAPTER 24Enhancing Linux Security with SELinux
Security Enhanced Linux (SELinux) was developed by the National Security Agency (NSA) along with other security research organizations, such as the Secure Computing Corporation (SCC). SELinux was released to the open source community in 2000, and it became popular when Red Hat included SELinux in its Linux distributions. Now, SELinux is used by many organizations and is widely available.
Understanding SELinux Benefits
SELinux is a security enhancement module deployed on top of Linux. It provides additional security measures, is included by default, and is set to be in enforcing mode in Red Hat Enterprise Linux (RHEL) and Fedora.
SELinux provides improved security on the Linux system via role based access controls (RBACs) on subjects and objects (aka processes and resources). “Traditional” Linux security uses Discretionary Access Controls (DACs).
With DAC, a process can access any file, directory, device, or other resource that leaves itself open to access. With RBAC, a process only has access to resources that it is explicitly allowed to access, based on the assigned role. The way that SELinux implements RBAC is to assign an SELinux policy to a process. That policy restricts access as follows:
- Only letting the process access resources that carry explicit ...
Get Linux Bible, 10th Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
