Author: Leland Jackson
Posted: 2005-03-05 at 15:06:47
Hi Ed,
As of Linux kernel 2.6.9 or 2.6.10, SELinux no longer is a module
separate from the kernel. This would not effect FC2, which evidentially
provides SELinux via a module or service. As of FC3, SELinux is no
longer a separate package, and has become a part of the kernel or Linux
OS. The kernel is the OS that exist entirely in memory and provides the
low level functions of the computer like memory management, video cards,
com ports, USB ports, EIDE, SCSI, ATA, SATA, hard drives, etc. All the
drivers for the hardware are compiled into the kernel. Now, SELinux is
also part of the kernel. Therefore, SELinux is not a FC2 issue, or FC3
issue, or a Redhat, Debian, or SuSE issue, etc, but a basic Linux issue.
I not sure whether SELinux is a required part of the kernel, or whether
it's a selectable option when compiling a custom kernel, so I'll wait on
FC3 or FC4 to address that.
Anyway, it seem a little strange that the default FC3 kernel has SELinux
compiled in with the default flag set to enabled. My guess is 97% of
the folks running Linux don't need the kind of security provided by
SELinux, so its odd that it is compiled into the kernel by default with
flag set to enabled. It could be that the Redhat folks are just trying
to do us a favor by compiling it into the kernel for us and having
everything ready to go upon installing it. This would be a good way to
encourage folks to learn something about SELinux, if nothing more than
how to turn it off. <g>
I'm just trying to find a little bit out about it, since its already
programmed to confront me when I move to FC3 or FC4. I kind of like to
know what I'm running and what its doing. The standard security
provided by Linux is very good, so I'm not very interested in SELinux
unless it really catches on and become pervasive.
Regards,
LelandJ
Leland Jackson wrote:
> Hi Ed,
>
> Maybe this will help:
>
> http://beta.centos.org/centos/4.0beta/docs/html/rhel-selg-en-4/selg-sect1-0015.html
>
>
> Regards,
>
> LelandJ
>
> Ed Leafe wrote:
>
>> On Mar 5, 2005, at 12:21 PM, Leland Jackson wrote:
>>
>>> If SELinux was an install option in FC2, it must have install like
>>> like MySQL, Apache httpd, NIS, etc, as a separate module, opposed to
>>> being compiled into the kernel. If I understand it correctly, NAS
>>> was/is doing a proof of concept in run SELinux as a part of the
>>> basic kernel, to see if it can be done without degradation to the
>>> overall system, and to see just how effective this kind of software
>>> can be handled within the kernel, so if I installed the default FC3
>>> kernel, or accept "up2date" yum kernel releases, I will be stuck
>>> with SELinux; whether I want/need it or not. This is a little
>>> troubling to me.
>>
>>
>>
>> I don't where you are getting your information, but this hasn't
>> been my experience at all. You had to explicitly choose SELinux;
>> nothing was 'forced' upon you.
>>
>> ___/
>> /
>> __/
>> /
>> ____/
>> Ed Leafe
>> Come to PyCon!!!! http://www.python.org/pycon/2005/
>>
>>
>>
[excessive quoting removed by server]