Hello, and welcome to today's video, where we'll chat about SELinux.
But why talk about SELinux?
For starters, I'm sure you've heard of it, right?
It's that common step in many online tutorials where the author instructs users to set the
status of SELinux to permissive or, even worse, disable it.
I'm sure you're now asking, "If changing the default behavior for SELinux to bypass or
off is that common, why even have it?"
Before I answer that question, let's start with what SELinux or Security-Enhanced Linux
is and does.
SELinux is a Linux Security Module (LSM) built into the Linux kernel.
This module provides an additional layer of system security above the standard access
policies based on users, groups, and others.
These standard policies, known as Discretionary Access Control or DAC, are the first level
of permissions checked when a user or the system attempts an action.
If these permissions fail the authorization check for the current action, the requested
task is refused.
However, authorization is passed along to the SELinux policies if these permissions
pass.
Although helpful, the limitation of DAC is it cannot provide the necessary level of security
needed to restrict the overall abilities of one application from the next.
So SELinux was developed, which implements Mandatory Access Control or MAC.
Through MAC, every process and file receives a security label referred to as an SELinux
context or SELinux label.
Thus providing detailed access control, system-wide admin-defined policies, and improved mitigation
for privilege escalation attacks.
Despite these added benefits, administrators still need to ensure they follow good security
practices.
Using SELinux does not replace the need for antivirus software, firewalls, or the use
of strong passwords.
So, what does this all look like on Oracle Linux?
Start by opening a terminal window.
Then get the status of SELinux by running `getenforce`.
The results are `Enforcing`.
For additional information, such as the SELinux policy used by the system, run the command
`sestatus`.
Enforcing is the default and preferred of three modes for SELinux, where it usually
operates by strictly implementing the loaded security policy on the entire system.
Now change the runtime SELinux mode by using `sudo setenforce 0`.
[Runtime changes do not survive a system reboot]
Again check the status with `getenforce`.
Just like that, our system is in Permissive mode.
While in this mode, SELinux acts like it's enforcing the loaded security policy, including
labeling objects and adding access denial entries in the logs.
Yet, it does not actually deny any operations.
While we do not recommend this mode for production, it's helpful when troubleshooting policy issues
or failures related to SELinux.
The last mode is Disabled mode.
Security policies are not loaded in this mode.
Further, Access Vector Cache (AVC) messages, known as SELinux policy violations, are not
logged to `/var/log/messages`.
So we get nothing!
Because of this, Disabled mode can not be triggered during runtime and requires making
a methodical configuration change, followed by a reboot of the system.
These extra steps further help discourage users from putting a system in Disabled mode.
Given Disabled mode is discouraged and further not recommended, we won't focus much on the
steps to switch to that mode, other than mentioning it requires modifying the `/etc/selinux/config`
file or passing the `selinux=0` boot parameter.
The only difference in these two methods is at which point in the boot process SELinux
is disabled.
So, if you are thinking about using Disabled mode, please don't.
If you administer a system where a previous admin used Disabled mode, then put the system
back into Permissive or Enforcing mode.
Upon making the switch, it's recommended to relabel the system on reboot.
These steps are automatic on Oracle Linux and help avoid problems with incorrect or
unlabeled files.
As a best practice, we also suggest doing this when booting into enforcing mode from
permissive mode.
Since the steps to relabel isn't automatic in this case, run the command `sudo fixfiles
-F onboot`.
This creates a `/.autorelabel` file containing the `-F` option to ensure that files are relabeled
upon the next reboot.
Another way to perform this step is by setting the boot parameter `autorelabel=1`, the equivalent
of running `touch /.autorelabel` and rebooting the system.
That was a fair bit of information in a short period, and we have only touched on SELinux
basics.
There is so much more you can do and learn on this subject.
To try some of these steps and other exercises for yourself, check out our free tutorials
and labs by clicking the card above or checking out links in the description of this video.
Thank you for watching.
For additional information on Oracle Linux, access the Oracle Linux Documentation or Oracle
Linux Learning Library.