Re: [ProLinux] Apache Virtual Hosting with Fedora Core 3 and SELinux

Author: Leland Jackson

Posted: 2005-03-05 at 15:06:47

Hi Ed,

As of Linux kernel 2.6.9 or 2.6.10, SELinux no longer is a module

separate from the kernel. This would not effect FC2, which evidentially

provides SELinux via a module or service. As of FC3, SELinux is no

longer a separate package, and has become a part of the kernel or Linux

OS. The kernel is the OS that exist entirely in memory and provides the

low level functions of the computer like memory management, video cards,

com ports, USB ports, EIDE, SCSI, ATA, SATA, hard drives, etc. All the

drivers for the hardware are compiled into the kernel. Now, SELinux is

also part of the kernel. Therefore, SELinux is not a FC2 issue, or FC3

issue, or a Redhat, Debian, or SuSE issue, etc, but a basic Linux issue.

I not sure whether SELinux is a required part of the kernel, or whether

it's a selectable option when compiling a custom kernel, so I'll wait on

FC3 or FC4 to address that.

Anyway, it seem a little strange that the default FC3 kernel has SELinux

compiled in with the default flag set to enabled. My guess is 97% of

the folks running Linux don't need the kind of security provided by

SELinux, so its odd that it is compiled into the kernel by default with

flag set to enabled. It could be that the Redhat folks are just trying

to do us a favor by compiling it into the kernel for us and having

everything ready to go upon installing it. This would be a good way to

encourage folks to learn something about SELinux, if nothing more than

how to turn it off. <g>

I'm just trying to find a little bit out about it, since its already

programmed to confront me when I move to FC3 or FC4. I kind of like to

know what I'm running and what its doing. The standard security

provided by Linux is very good, so I'm not very interested in SELinux

unless it really catches on and become pervasive.

Regards,

LelandJ

Leland Jackson wrote:

> Hi Ed,

>

> Maybe this will help:

>

> http://beta.centos.org/centos/4.0beta/docs/html/rhel-selg-en-4/selg-sect1-0015.html

>

>

> Regards,

>

> LelandJ

>

> Ed Leafe wrote:

>

>> On Mar 5, 2005, at 12:21 PM, Leland Jackson wrote:

>>

>>> If SELinux was an install option in FC2, it must have install like

>>> like MySQL, Apache httpd, NIS, etc, as a separate module, opposed to

>>> being compiled into the kernel. If I understand it correctly, NAS

>>> was/is doing a proof of concept in run SELinux as a part of the

>>> basic kernel, to see if it can be done without degradation to the

>>> overall system, and to see just how effective this kind of software

>>> can be handled within the kernel, so if I installed the default FC3

>>> kernel, or accept "up2date" yum kernel releases, I will be stuck

>>> with SELinux; whether I want/need it or not. This is a little

>>> troubling to me.

>>

>>

>>

>> I don't where you are getting your information, but this hasn't

>> been my experience at all. You had to explicitly choose SELinux;

>> nothing was 'forced' upon you.

>>

>> ___/

>> /

>> __/

>> /

>> ____/

>> Ed Leafe

>> http://leafe.com/

>> http://dabodev.com/

>> Come to PyCon!!!! http://www.python.org/pycon/2005/

>>

>>

>>

[excessive quoting removed by server]

©2005 Leland Jackson