SELinux

Chapter 1. Introducing SELinux

This chapter explains the what and why of SELinux. It begins by describing the threat environment and why the prevalent model of security—patching against known vulnerabilities—is inadequate. The chapter goes on to describe several security mechanisms designed to protect against both known and unknown vulnerabilities. The chapter then presents an overview of SELinux, describing its main features, capabilities, and history. The chapter concludes with a survey of resources helpful to SELinux users.

Software Threats and the Internet

Because you’re reading this book, it’s likely that you’re responsible for the management of one or more sensitive hosts. If that’s the case, you’re aware that the threat level for Internet-based attacks has increased rapidly over the last several years and continues to do so. One authoritative barometer of this trend is the number of incident reports logged by the Computer Emergency Response Team Coordination Center (CERT/CC) of Carnegie Mellon University’s Software Engineering Institute. Table 1-1 shows the number of incident reports for 2000 through 2003. During this four-year period, incident reports increased at an average annual rate of almost 85 percent. That is, the number of incidents has roughly doubled each year. If this rapid rate of increase continues, the year 2010 will see over 10 million incident reports.

Table 1-1. CERT/CC incident reports^[1]

Year	Reports
2000	21,756
2001	52,658
2002	82,094
2003