This question already has an answer here:

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However I closed all ports except apache(port443), SSH(port 1953(Public/Private Key)) and MySQL. And a 64 character password for login to the site on port 443.

Is it safe enough?

marked as duplicate by symcbean, WhiteWinterWolf, Steve Dodier-Lazaro, Rory Alsop Dec 23 '15 at 12:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 5
    Safe enough for what? There are probably millions of servers that are running without SELinux, AppArmor, or an equivalent. – Neil Smithline Dec 23 '15 at 3:28
  • I want to run owncloud server. I mean, the MACs isolate apps from each other and restrict access of apps, but without a MAC, is it possible to access the owncloud data folder through other apps like MySQL? – mohammads Dec 23 '15 at 5:29
  • @Mohammads Can you be more clear with above requirement? – Krishna Pandey Dec 23 '15 at 8:02
  • both SElinux or Apparmor are in place for a reason. going without them is just risk taking. as for "Is it safe enough?" - one should assume that nothing is never safe enough. – JOW Dec 23 '15 at 8:32
  • This question can only be answered if we know: (a) what applications are expected to run, for whom, and what the relationships between the involved principals are; (b) who wrote the SELinux policies (many are just bad / useless); and (c) what the threat model is. MAC systems provide containment for server-like apps but that's only truly useful in some contexts. Sometimes it's just decorum. Note also that other containment solutions may be more adapted to some contexts where SELinux usage is delusional (e.g. running multiple Apache instances for mutually distrusting clients). – Steve Dodier-Lazaro Dec 23 '15 at 11:40

SELinux (as well as AppArmor) are used to restrict the actions of users and processes on the system. A classic example is that the httpd process should not have access to files outside of the usual /var/www/html.

This means that SELinux is the last defense on your server that prevents an attacker from doing worse things than what is available to the exploited process already. If you have properly configured services and updated packages, then SELinux has no advantages outside of any potential 0day flaws.

There are tons of servers that don't use either of these technologies. SELinux in particular has a bad rep for being difficult to configure so you'll see recommendations to disable it as soon as you install a new system (I disagree with this). Also, loads of VPSes that run limited virtual machine images do not come with SELinux support so there are tons of web servers out there not using it.

  • Thank you martin for the replay, but would you please share a reference about this? – mohammads Dec 23 '15 at 11:25
  • 1
    There is much more to SELinux than you state in your answer, e.g. limitation of root roles which can protect from your sysadmins connecting from the outside with a compromised device, or from password theft. SELinux can also be used to implement MCS and add a layer of isolation between several unprivileged (user;role)s who are mutually distrusting and run their own software. – Steve Dodier-Lazaro Dec 23 '15 at 11:42
  • @SteveDL Of course there is :-) SELinux can be used for MLS, securing VMs with sVirt, confining specific users, and much more. My answer is definitely not an exhaustive description of what SELinux does, rather what it is most used as in a common server environment. – mart1n Jan 4 '16 at 7:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.