Language Selection

English French German Italian Portuguese Spanish

SELinux: Comprehensive security at the price of usability

Filed under
Linux

Operating system security revolves around controlling access. Linux distributions subscribe to the Discretionary Access Control (DAC) mechanism that lets resource owners decide who gets to access the resource and how. People soon realized that DAC is not an ideal solution, as it gives applications the same privileges of the user running them. One compromised application running as root effectively compromises the full system. This led security experts to develop Mandatory Access Control (MAC), which grants access to resources as defined by a security policy, regardless of the user running the application. The Security Enhanced Linux (SELinux) project is the first mainstream implementation of MAC.

The benefit of SELinux is twofold. First, it replaces the user-based model with a policy-centric model. Every action, like running an application or reading and modifying data, is controlled by a security policy. Actions that violate the policy are denied. Additionally, SELinux compartmentalizes the various applications and processes running on the system. This not only helps in isolating a break-in, but also confines the damage caused by one compromised service.

SELinux plugs into the Linux distribution through the Linux Security Module (LSM) hooks, which are available in the 2.6.x kernel series. LSM was designed to integrate security models to work with the kernel, instead of applying them as a patch.

Full Story.

More in Tux Machines

Linux 4.10-rc5

Things seem to be calming down a bit, and everything looks nominal. There's only been about 250 changes (not counting merges) in the last week, and the diffstat touches less than 300 files (with drivers and architecture updates being the bulk, but there's tooling, networking and filesystems in there too). Read more Also: Linus Torvalds Announces Fifth Linux 4.10 Kernel RC, Everything Looks Nominal Linux 4.10-rc5 Released, Now Codenamed "Anniversary Edition"

Fedora 26 Linux to Enable TRIM for Better Performance of Encrypted SSD Disks

According to the Fedora 26 release schedule, the upcoming operating system is approaching an important milestone, namely the proposal submission deadline for system-wide changes, which is currently set for January 31. Read more Also: Fedora 26 Planning To Enable TRIM/Discard On Encrypted Disks

New CloudLinux 7 and CloudLinux 6 Linux Kernel Security Updates Pushed Into Beta

CloudLinux's Mykola Naugolnyi is informing users of the CloudLinux 7 and CloudLinux 6 enterprise-ready operating systems to upgrade their kernel packages immediately if they are using the Beta channel. Read more

KDE Neon Installer

  • KDE Neon Has Stylish New Install Wizard
    KDE Neon has adopted distro-agnostic Linux installer ‘Calamares’ its unstable developer edition. Calamares replaces the Canonical-developed Ubiquity installer as the default graphical installer used when installing the Ubuntu-based OS on a new machine. The stylish install wizard is already in use on a number of other KDE-based Linux distributions, including Chakra Linux and Netrunner.
  • KDE neon Inaugurated with Calamares Installer
    You voted for change and today we’re bringing change. Today we give back the installer to the people. Today Calamares 3 was released. It’s been a long standing wish of KDE neon to switch to the Calamares installer. Calamares is a distro independent installer used by various projects such as Netrunner and Tanglu. It’s written in Qt and KDE Frameworks and has modules in C++ or Python.