Author: Ted Roche
Posted: 2005-03-04 15:48:01 Link
From my blog at
The Fedora Core 3 Linux distribution includes a very powerful new
security feature called SELinux. In my (very) limited understanding,
SELinux overlays another set of policies and permissions over the basic
UNIX-style security to produce a far more secure product. However, it
can also trip up the unsuspecting. At last night's LAMP class, we got
caught. Installing Virtual Hosts as we had with Fedora Core 2 threw
permission errors, despite everything we could think of. As it was a
beginner class, we just settled for placing the virtual hosts under the
standard DocumentRoot at /var/www/html and continuing on with our
exercise, with a promise that we'd investigate and explain to the
students what went wrong at the next class.
The Fedora web site provides guidance at "<a
href="Understanding" target="_blank">http://fedora.redhat.com/docs/selinux-apache-fc3/">Understanding
and Customizing the Apache HTTP SELinux Policy</a>." I was also pleased
to see that a WebMin module is under development to simplify SElinux
management at
http://www.selinux.hitachi-sk.co.jp/en/tool/selpe/selpe-top.html
Author: Leland Jackson
Posted: 2005-03-04 17:44:05 Link
Hi Ted
SELinux is turned off by default in FC2, but turned on by default in
FC3. Unless a web site need C3 security, you could just turn SELinux
off in FC3. I read NSA (eg The National Security Agency) has worked
with Redhat for the past ten years in creating SELinux. NSA is
America's largest security agency number something like 20 people for
every 1 person in other agencies like the FBI, CIA, etc. It may now be
one of the 22 or so agencies under the homeland security umbrella. I
pulled this off the web, which is interesting:
######################################
The whole purpose of creating a secure OS is to protect against attacks
when connected to an insecure network like the Internet. If you don't
connect the system to the Internet, then you don't need a secure
computer. Even Windows is OK for security if it isn't connected to the
network. Microsoft boasted about C3 security certification for Windows
NT a while back - the problem was that the C3 security rating was
achieved only if Windows NT wasn't connected to the network. The moment
you connect a Windows PC to a network, the security rating goes to zip.
NSA created SE Linux to use on the Internet, other insecure networks,
and on the US military network of which the Internet is a civilian
version. In addition to using it for highest security US government
Internet and military network connected systems, NSA also uses SELinux
for honeypot servers to catch hackers. This is a server connected to the
Internet which has insecure services deliberately installed to lure
hackers, so that they can be traced, and arrested. The NSA demonstrated
an SE Linux honeypot server where hackers had broken into the trap, got
root access to the system but couldn't do any damage or gain access to
privileged data, allowing tracking of the hacker's activities without
the hacker knowing.
#######################################
Regards,
LelandJ
Ted Roche wrote:
> From my blog at
>
> The Fedora Core 3 Linux distribution includes a very powerful new
> security feature called SELinux. In my (very) limited understanding,
> SELinux overlays another set of policies and permissions over the
> basic UNIX-style security to produce a far more secure product.
> However, it can also trip up the unsuspecting. At last night's LAMP
> class, we got caught. Installing Virtual Hosts as we had with Fedora
> Core 2 threw permission errors, despite everything we could think of.
> As it was a beginner class, we just settled for placing the virtual
> hosts under the standard DocumentRoot at /var/www/html and continuing
> on with our exercise, with a promise that we'd investigate and explain
> to the students what went wrong at the next class.
>
> The Fedora web site provides guidance at "<a
> href="Understanding" target="_blank">http://fedora.redhat.com/docs/selinux-apache-fc3/">Understanding
> and Customizing the Apache HTTP SELinux Policy</a>." I was also
> pleased to see that a WebMin module is under development to simplify
> SElinux management at
> http://www.selinux.hitachi-sk.co.jp/en/tool/selpe/selpe-top.html
>
>
>
[excessive quoting removed by server]
Author: Ted Roche
Posted: 2005-03-05 09:36:43 Link
On Mar 4, 2005, at 5:44 PM, Leland Jackson wrote:
> Unless a web site need C3 security, you could just turn SELinux off in
> FC3.
Which can be done in several ways, as described here:
http://fedora.redhat.com/docs/selinux-faq-fc3/index.html#id2825880
The reason I posted was to alert others to the symptoms and problems
they might run into when working on FC3. In this case, it ate up a lot
of valuable classroom time.
Ted Roche
Ted Roche & Associates, LLC
Author: Leland Jackson
Posted: 2005-03-05 11:12:24 Link
Yep, Thanks for the alert Ted. I'm not sure I like the idea of having
SELinux compiled into the kernel. I think it should be an option for a
custom compiled kernel, for those that really need that much security.
It seems like NAS is everywhere. NAS had a back door signature key,
along with Microsoft back door key that lay undiscovered and unknown,
even by Microsoft, until recently. The key had existed in windows since
early version of windows 95.
From what I've read on the web, turning on SELinux can degrade Linux
performance between 5 to 7 percent. I guess it involves process
accounting so all users on the system are tracked ever step they make,
and any mischief can then be easily traced back to the offender. I seem
strange to me that SELinux would be set to "SELINUX=enforcinfg" (eg
turned on) in the /etc/sysconfig/selinux file , or even precompiled into
the kernel for the default distribution. One explanation is that
SELinux use in FC2 was disappointing, so having it turned on by default
would increase exposure, training and use of this prototype.
At least in Linux we can download the SELinux source to have a peek, but
their is no way to be sure about the kernel that come precompiled with
SELinux from our distributors.
Regards,
LelandJ
Ted Roche wrote:
> On Mar 4, 2005, at 5:44 PM, Leland Jackson wrote:
>
>> Unless a web site need C3 security, you could just turn SELinux off
>> in FC3.
>
>
> Which can be done in several ways, as described here:
>
> http://fedora.redhat.com/docs/selinux-faq-fc3/index.html#id2825880
>
> The reason I posted was to alert others to the symptoms and problems
> they might run into when working on FC3. In this case, it ate up a lot
> of valuable classroom time.
>
> Ted Roche
> Ted Roche & Associates, LLC
>
>
>
[excessive quoting removed by server]
Author: Ed Leafe
Posted: 2005-03-05 11:27:18 Link
On Mar 5, 2005, at 11:12 AM, Leland Jackson wrote:
> I'm not sure I like the idea of having SELinux compiled into the
> kernel. I think it should be an option for a custom compiled kernel,
> for those that really need that much security.
Dunno about FC3, but when I installed FC2, it gave me the option to
include it or not.
___/
/
__/
/
____/
Ed Leafe
Come to PyCon!!!! http://www.python.org/pycon/2005/
Author: Leland Jackson
Posted: 2005-03-05 12:21:24 Link
Hi Ed,
When I installed FC2 on my desktop, I choose to install the entire ball
of wax, so I could take a look at everything and stay abreast of all
changes. If SELinux was an install option in FC2, it must have install
like like MySQL, Apache httpd, NIS, etc, as a separate module, opposed
to being compiled into the kernel. If I understand it correctly, NAS
was/is doing a proof of concept in run SELinux as a part of the basic
kernel, to see if it can be done without degradation to the overall
system, and to see just how effective this kind of software can be
handled within the kernel, so if I installed the default FC3 kernel, or
accept "up2date" yum kernel releases, I will be stuck with SELinux;
whether I want/need it or not. This is a little troubling to me.
We are eventully going to be stuck with NAS anyway, as the tools needed
to intrude systems and protect aginst intruders are moving towards being
embedded in the computer's CPU and other motherboard chips that make up
the hardware.
Regards,
LelandJ
Ed Leafe wrote:
> On Mar 5, 2005, at 11:12 AM, Leland Jackson wrote:
>
>> I'm not sure I like the idea of having SELinux compiled into the
>> kernel. I think it should be an option for a custom compiled kernel,
>> for those that really need that much security.
>
>
> Dunno about FC3, but when I installed FC2, it gave me the option
> to include it or not.
>
> ___/
> /
> __/
> /
> ____/
> Ed Leafe
> Come to PyCon!!!! http://www.python.org/pycon/2005/
>
>
>
[excessive quoting removed by server]
Author: Ed Leafe
Posted: 2005-03-05 13:24:56 Link
On Mar 5, 2005, at 12:21 PM, Leland Jackson wrote:
> If SELinux was an install option in FC2, it must have install like
> like MySQL, Apache httpd, NIS, etc, as a separate module, opposed to
> being compiled into the kernel. If I understand it correctly, NAS
> was/is doing a proof of concept in run SELinux as a part of the basic
> kernel, to see if it can be done without degradation to the overall
> system, and to see just how effective this kind of software can be
> handled within the kernel, so if I installed the default FC3 kernel,
> or accept "up2date" yum kernel releases, I will be stuck with SELinux;
> whether I want/need it or not. This is a little troubling to me.
I don't where you are getting your information, but this hasn't been
my experience at all. You had to explicitly choose SELinux; nothing was
'forced' upon you.
___/
/
__/
/
____/
Ed Leafe
Come to PyCon!!!! http://www.python.org/pycon/2005/
Author: Leland Jackson
Posted: 2005-03-05 13:55:47 Link
Hi Ed,
Maybe this will help:
http://beta.centos.org/centos/4.0beta/docs/html/rhel-selg-en-4/selg-sect1-0015.html
Regards,
LelandJ
Ed Leafe wrote:
> On Mar 5, 2005, at 12:21 PM, Leland Jackson wrote:
>
>> If SELinux was an install option in FC2, it must have install like
>> like MySQL, Apache httpd, NIS, etc, as a separate module, opposed to
>> being compiled into the kernel. If I understand it correctly, NAS
>> was/is doing a proof of concept in run SELinux as a part of the basic
>> kernel, to see if it can be done without degradation to the overall
>> system, and to see just how effective this kind of software can be
>> handled within the kernel, so if I installed the default FC3 kernel,
>> or accept "up2date" yum kernel releases, I will be stuck with
>> SELinux; whether I want/need it or not. This is a little troubling
>> to me.
>
>
> I don't where you are getting your information, but this hasn't
> been my experience at all. You had to explicitly choose SELinux;
> nothing was 'forced' upon you.
>
> ___/
> /
> __/
> /
> ____/
> Ed Leafe
> Come to PyCon!!!! http://www.python.org/pycon/2005/
>
>
>
[excessive quoting removed by server]
Author: Ed Leafe
Posted: 2005-03-05 14:30:09 Link
On Mar 5, 2005, at 1:55 PM, Leland Jackson wrote:
> Maybe this will help:
>
> http://beta.centos.org/centos/4.0beta/docs/html/rhel-selg-en-4/selg-
> sect1-0015.html
Not really, as it says nothing about forcing SELinux to be installed.
This is more to the point:
http://fedora.redhat.com/docs/selinux-faq-fc2/
Excerpt: "SELinux in Fedora Core 2 represents the labor and lessons
learned throughout the testing process. Version 2 features full
support for SELinux, but the default installation behavior is
disabled. To install SELinux, you need to pass the selinux option to
the installer."
___/
/
__/
/
____/
Ed Leafe
Come to PyCon!!!! http://www.python.org/pycon/2005/
Author: Leland Jackson
Posted: 2005-03-05 15:06:47 Link
Hi Ed,
As of Linux kernel 2.6.9 or 2.6.10, SELinux no longer is a module
separate from the kernel. This would not effect FC2, which evidentially
provides SELinux via a module or service. As of FC3, SELinux is no
longer a separate package, and has become a part of the kernel or Linux
OS. The kernel is the OS that exist entirely in memory and provides the
low level functions of the computer like memory management, video cards,
com ports, USB ports, EIDE, SCSI, ATA, SATA, hard drives, etc. All the
drivers for the hardware are compiled into the kernel. Now, SELinux is
also part of the kernel. Therefore, SELinux is not a FC2 issue, or FC3
issue, or a Redhat, Debian, or SuSE issue, etc, but a basic Linux issue.
I not sure whether SELinux is a required part of the kernel, or whether
it's a selectable option when compiling a custom kernel, so I'll wait on
FC3 or FC4 to address that.
Anyway, it seem a little strange that the default FC3 kernel has SELinux
compiled in with the default flag set to enabled. My guess is 97% of
the folks running Linux don't need the kind of security provided by
SELinux, so its odd that it is compiled into the kernel by default with
flag set to enabled. It could be that the Redhat folks are just trying
to do us a favor by compiling it into the kernel for us and having
everything ready to go upon installing it. This would be a good way to
encourage folks to learn something about SELinux, if nothing more than
how to turn it off. <g>
I'm just trying to find a little bit out about it, since its already
programmed to confront me when I move to FC3 or FC4. I kind of like to
know what I'm running and what its doing. The standard security
provided by Linux is very good, so I'm not very interested in SELinux
unless it really catches on and become pervasive.
Regards,
LelandJ
Leland Jackson wrote:
> Hi Ed,
>
> Maybe this will help:
>
> http://beta.centos.org/centos/4.0beta/docs/html/rhel-selg-en-4/selg-sect1-0015.html
>
>
> Regards,
>
> LelandJ
>
> Ed Leafe wrote:
>
>> On Mar 5, 2005, at 12:21 PM, Leland Jackson wrote:
>>
>>> If SELinux was an install option in FC2, it must have install like
>>> like MySQL, Apache httpd, NIS, etc, as a separate module, opposed to
>>> being compiled into the kernel. If I understand it correctly, NAS
>>> was/is doing a proof of concept in run SELinux as a part of the
>>> basic kernel, to see if it can be done without degradation to the
>>> overall system, and to see just how effective this kind of software
>>> can be handled within the kernel, so if I installed the default FC3
>>> kernel, or accept "up2date" yum kernel releases, I will be stuck
>>> with SELinux; whether I want/need it or not. This is a little
>>> troubling to me.
>>
>>
>>
>> I don't where you are getting your information, but this hasn't
>> been my experience at all. You had to explicitly choose SELinux;
>> nothing was 'forced' upon you.
>>
>> ___/
>> /
>> __/
>> /
>> ____/
>> Ed Leafe
>> Come to PyCon!!!! http://www.python.org/pycon/2005/
>>
>>
>>
[excessive quoting removed by server]