Selinux under FC-4 ?

[Timothy Murphy]

Will I be able to turn off selinux under FC-4 ?

Life is hard enough without inventing problems ...

-- 
Timothy Murphy  
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

[Stephen Smalley]

On Wed, 2005-03-30 at 13:53 +0100, Timothy Murphy wrote:
>  Will I be able to turn off selinux under FC-4 ?
>  
>  Life is hard enough without inventing problems ... 
You should always be able to turn it off during the install or
subsequently using system-config-securitylevel.  No plans to change that
AFAIK.  But I'm not sure what you mean by the latter statement.

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency

[Timothy Murphy]

Stephen Smalley wrote:

> > Will I be able to turn off selinux under FC-4 ?
> > 
> > Life is hard enough without inventing problems ...
>  
>  You should always be able to turn it off during the install or
>  subsequently using system-config-securitylevel.  No plans to change that
>  AFAIK.  But I'm not sure what you mean by the latter statement. 
While selinux is probably important for big systems,
I don't think it offers much for a home user like myself.
It's possible, I suppose, that someone might get through my firewall
(shorewall) but it doesn't seem very likely,
as I don't run any services visible from outside.

On the other hand, when I very gently tested the water with selinux
it had a number of unforeseen consequences,
and it was clear that I would have to study the matter
if I were to run the selinux service.

 

-- 
Timothy Murphy  
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

[Colin Walters]

On Thu, 2005-03-31 at 02:15 +0100, Timothy Murphy wrote:
>  Stephen Smalley wrote:
>  
>  >> Will I be able to turn off selinux under FC-4 ?
>  >> 
>  >> Life is hard enough without inventing problems ...
>  > 
>  > You should always be able to turn it off during the install or
>  > subsequently using system-config-securitylevel.  No plans to change that
>  > AFAIK.  But I'm not sure what you mean by the latter statement.
>  
>  While selinux is probably important for big systems,
>  I don't think it offers much for a home user like myself.
>  It's possible, I suppose, that someone might get through my firewall
>  (shorewall) but it doesn't seem very likely,
>  as I don't run any services visible from outside. 
The real threat for your kind of system has always really been flaws in
programs like firefox, movie players, image loaders, etc., not network
daemons.  While it's true that in Fedora right now the targeted SELinux
policy does not confine those programs, in the future it will.
Disabling it now will also disable the protection we will add in the
future.

For a home user system you're not likely running Apache HTTPD, so I
don't see why you have trouble with the current policy anyways.

[Timothy Murphy]

Colin Walters wrote:

>  For a home user system you're not likely running Apache HTTPD, so
> I
>  don't see why you have trouble with the current policy anyways. 
Actually I am running httpd on my desktop (for internal use).
IIRC, that was where some at least of my selinux problems appeared.

However, I'm happy enough for selinux to be there,
as long as I can turn it off.

One day, when I have lots of time to spare I'll study it ...


-- 
Timothy Murphy  
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

[Colin Walters]

On Thu, 2005-03-31 at 15:31 +0100, Timothy Murphy wrote:
>  Colin Walters wrote:
>  
>  > For a home user system you're not likely running Apache HTTPD, so I
>  > don't see why you have trouble with the current policy anyways.
>  
>  Actually I am running httpd on my desktop (for internal use).
>  IIRC, that was where some at least of my selinux problems appeared. 
Ok.  You can turn enforcement off just for Apache, you know:
http://fedora.redhat.com/docs/selinux-faq-fc3/index.html#using-s-c-securi...

This is far more preferable than disabling entirely.

>  However, I'm happy enough for selinux to be there,
>  as long as I can turn it off. 
Please don't do that; reporting bugs instead (and perhaps disabling
enforcement for pecific services as an interim measure) will help us
solve problems and benefit everyone.

[Stephen Smalley]

On Thu, 2005-03-31 at 02:15 +0100, Timothy Murphy wrote:
>  While selinux is probably important for big systems,
>  I don't think it offers much for a home user like myself. 
Desktop users are vulnerable to exploitation by malicious code and
malicious data-driven attacks.

http://www.nsa.gov/selinux/papers/inevitability/
http://www.selinux-symposium.org/2005/presentations/session3/3-1-walters.pdf

>  It's possible, I suppose, that someone might get through my
> firewall
>  (shorewall) but it doesn't seem very likely,
>  as I don't run any services visible from outside. 
Do you ran any client software that talks to the network (browser, irc,
whatever)?  If so, it has the potential to be exploited.  Or download
any code and run it?  Or play any downloaded music?  Or view any
downloaded documents?  All of this opens you up to potential
exploitation of flaws in the programs you use or active maliciousness in
any code you run.

>  On the other hand, when I very gently tested the water with selinux
>  it had a number of unforeseen consequences,
>  and it was clear that I would have to study the matter
>  if I were to run the selinux service. 
Yes, there is a learning curve, and it is a paradigm change for
security.  Nonetheless, necessary if you want to solve fundamental
security problems.

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency