Understanding SELinux How it works

SELinux on Ubuntu

Here is a simple objective of this post is to install, activate and disable the SELinux on Ubunutu.

How does SELinux works?


What is actually SELinux?

Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. Security-Enhanced Linux is a Linux kernel security module that provides a mechanism for supporting access control security policies, including mandatory access controls. SELinux is a set of kernel modifications and user-space tools that have been added to various Linux distributions.

Here I'll explore the possible options on Ubuntu.

How to install SELinux on Ubuntu?

This regular package installation
apt install policycoreutils selinux-utils selinux-basics -y

How to activate SELinux on Ubuntu?

To activate the SELinux we need to edit the config file.
selinux-activate

To get this effected need to reboot the Linux VM/machine.

Understanding Configure SELinux


SELinux configuration file available at /etc/selinux/config
The configuration contains two directives in the config file:
I. SELINUX that dictates SELinux Mode and it can have three values as shown
SELinux modules can take one of these three values
1. enforcing - any unauthorized access attempts by users and processes are denied
2. permissive - semi-enabled state, SELinux doesn't apply its policy in Permissive mode, so no access is denied instead it gives a warning
3. disabled - No SELinux policy is loaded

II. SELINUXTYPE tells that what policy will be used.
 SELINUXTYPE= can take one of these three values:
 default - equivalent to the old strict and targeted policies
 mls     - Multi-Level Security (for military and educational use)
 src     - Custom policy built from source

How to disable SELinux on Ubuntu?

To disable this feature edit the config file and change
SELINUX=permissive
to
SELINUX=disable
after disabled

How do you know the current mode of SELinux?

There are two options to know about the SELinux current status which includes a current mode.
getenforce # to check the current SELinux mode
sestatus # SELinux status
Example output of 'sestatus' command
before reboot sestatus output
When it has no changes in configuration This is the requirement for running Docker and Kubernetes.

Troubleshooting on SELinux Configuration

Here is a very minute mistake instead 'disabled' used 'disable' then the sestatus shows the 'error' :

Comments

Popular posts from this blog

Ansible Jinja2 Templates: A Complete Guide with Examples

Ansible 11 The uri module with examples

DevOps Weapons