What is SELinux?

SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) security system built into the Linux kernel that enforces strict policies to control what users and programs can access, preventing unauthorized actions even if a process is compromised.

• Displays SELinux status, modes, and security contexts in a structured format.
• Helps in securing systems and preventing privilege escalation attacks.
• Stores security policies that are enforced by the Linux kernel.
• Commonly used in RHEL, CentOS, Fedora, and other enterprise distributions.

Let us consider an example to check SELinux status:

Command:

sestatus

Output:

This command displays the current SELinux configuration, including whether it's enabled, the current mode, and the loaded policy.

Syntax of SELinux Commands

The basic syntax varies by command, but common ones include:

sestatus [options]
setenforce [0|1]
getenforce
semanage [object_type] [options]

Here,

• [options] = Various command-line options to customize behavior
• [0|1] = 0 for permissive mode, 1 for enforcing mode
• [object_type] = Specific SELinux object like port, fcontext, or boolean

Key Features of SELinux

Below is a list of the essential features of SELinux:

• Mandatory Access Control (MAC): SELinux enforces security policies system-wide, unlike traditional Discretionary Access Control (DAC) where users control permissions.
• Default Deny Principle: If not explicitly allowed by policy, access is automatically blocked.
• Root User Restrictions: Even root users must comply with SELinux policies, preventing privilege escalation attacks.
• Security Labels (Contexts): Uses labels with four components: user, role, type, and level to make access decisions.
• Additional Security Layer: Operates alongside traditional Linux permissions as an extra protection layer.

SELinux Labels and Type Enforcement

SELinux uses labels with policy rules to decide what actions to allow for each resource. Admins assign labels to every process, network port, file, etc. Labels include:

• User: The Linux user mapped to a SELinux user
• Role: The user's authorized role for that system
• Type: This determines the permissions that are enforced (most important)
• Level (optional): A security clearance level

Label format:

user:role:type:level

• The type part of the SELinux security label is the most critical element.
• Type Enforcement mandates that SELinux checks the type labels of both the accessing subject (user/program) and the target object (resource).
• Access is only granted if the security types align with the defined policy rules.
• Every defined type has an explicit list of permitted actions (e.g., read, write, execute).
• When a program attempts to access a resource, SELinux compares their type labels; if the combination is authorized by the policy, access is permitted.

SELinux Modes

SELinux operates in three different modes:

1. Enforcing Mode: This is the default and most secure mode. SELinux actively enforces the policy rules, denying any unauthorized access attempts. Blocked attempts are logged.

2. Permissive Mode: Less secure but still monitors access. SELinux just logs what would be blocked by policies but doesn't actually block it. Useful for testing and troubleshooting.

3. Disabled Mode: SELinux is completely turned off, removing all access protection. This mode is only for troubleshooting and should not be used in production.

How to Configure SELinux

Linux comes with pre-set SELinux security rules, making it easy to configure. Admins can also create their own rules. There are two main ways to configure SELinux - permanently or just for the current session.

Configure SELinux Permanently

Steps to configure SELinux permanently:

Step 1: To set SELinux rules that persist even after restarting, edit the /etc/selinux/config file. This file controls the SELinux settings.

Step 2: Restart your computer and then Use the below command to verify the new setting is applied.

Command :

sudo sesstatus

Output :

Configure SELinux Temporarily

You can also change SELinux settings just for your current session. These changes get reset after the restarting. Use the "setenforce" command to Enable selinux temporarily use the first command to Turn on enforcing mode and use the second command to Turn off enforcing mode.

Command :

setenforce 0

setenforce 1

Output :

Linux Vs SELinux

Purpose: Linux is the operating system that manages hardware and software resources on a computer. SELinux is a security component that protects Linux from malicious software and unauthorized access.

Access Control Enforcement: In normal Linux, users and apps can access the whole system if they have the right permissions. This is called Discretionary Access Control (DAC). With SELinux, admins set exact permissions for each user, program, and resource. SELinux blocks any access attempts that admins do not allow through security policies.

AppArmor Vs SELinux

AppArmor and SELinux both protect systems from malicious software and unauthorized access, but they work differently.

In short The SELinux is a crucial security system that enhances Linux by adding mandatory access controls and granular policies to tightly restrict what users and programs can access on the system.