SELinux is a Linux kernel security module that adds mandatory access control (MAC) by labeling files and enforcing policies for users and groups.
Created by Red Hat and the NSA, it comes built into CentOS and Fedora and can be installed on other Linux and Unix distributions through kernel security modules.
Install the packages:
sudo apt update sudo apt install policycoreutils selinux-utils selinux-basics -y
Check the status and activate:
sestatus sudo selinux-activate sudo reboot
After the first reboot, the system will reboot automatically one more time.
By default, SELinux will be in permissive mode when enabled.
Permissive mode allows applications to access files even if they are not labeled correctly, but it logs all violations.
Enforcing mode restricts access based on SELinux labeling policies.
sudo selinux-config-enforcing sestatus
Use the following commands to get or set the current mode:
getenforce setenforce setenforce 0
The mode can also be set in the configuration file:
sudo nano /etc/selinux/config
Or modified directly with these commands:
sudo sed -i 's/SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
sudo sed -i 's/SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
sudo sed -i 's/SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
To see the labels assigned to files in a directory:
ls -Zd
Change a label:
semanage fcontext -a -t FILE_TYPE "/web"
For a web server, the FILE_TYPE would be httpd_sys_content_t.
Apply the changes:
restorecon -Rv /web
Check the log for access violations:
grep AVC /var/log/messages
AVC (Access Vector Cache) can be understood as an access violation log.
You can also look for alerts in the same file:
grep sealert /var/log/messages
Then copy and run the command for the alert you want more details on, for example:
sealert -l askjc1c63deb-2af3-9d23-a3247a234ab34
Note that newly created files inherit labels from the parent directory. Moved files, however, keep their original labels and will need to be re-labeled manually.
A good practice is to keep the system in permissive mode first, review the logs, and apply all necessary labels for your running applications before switching to enforcing mode.
In conclusion, SELinux requires significant effort to label the entire file system before enforcing mode can be safely enabled. Without this preparation, it will likely break many applications and possibly the system itself.
SELinux is built into RHEL-based distributions. Installing it on a Debian-based distribution is straightforward but may cause side effects and should be done carefully.
A native alternative for Debian-based distributions is AppArmor. It runs as a service rather than being embedded in the kernel, but offers similar security features. Read more about it at [Link].
Seccomp is also worth looking into. It sandboxes applications to limit the impact of vulnerabilities, which is useful in Kubernetes pod/node/cluster environments. It uses a profile to allow or deny permissions, restricting a process to only the namespaces and system calls it needs. It is simpler than AppArmor and much simpler than SELinux, but follows the same core concept.