Selinuxaudit expirience 4598

On Sat, 27 Aug 2005 19:40:42 +0200, Michael Heiming

I think selinux is both useful and troublesome. But there is true need for program like selinux.

Currently linux has many applications ( iptables, tcpwrappers, xinet.d, pam ...) which give you some extra security, of cource only when they are correctly configured. But there are none to do what selinux is supposed to.

Selinux gives you a great protection in multiuser machines, where you as admin, don't always know whether or not all users are wearing white hats. When hacker using non-root account tries to gain root's privileges, selinux is pain in the hackers butt. It is much easier to use selinux than try to test and correct every other program which might help bad boys to take over your computer. When there are bugs in other software, selinux saves your day.

I find there are problems with selinux, some may be solved in future and other not. For example in RH9 I ran licensing server with

rc.local su - user1 -c 'umask 022; licensing.server...'

This is not possible anymore with selinux, only root is allowed to ran such server software. Other problem is with virus scanning software. F-secure's anti-virus system want to install component which conflicts which selinux.