2

Im trying to find a good comparison between SELinux vs Vanilla Red Hat. Im building a mission critical system, and am looking for the best security measures regardless of complexity to setup.

Does anyone have some comparisons they can share, or compare them?

Thank you

closed as off-topic by Anders, S.L. Barth - Reinstate Monica, Polynomial, techraf, Matthew Sep 23 '16 at 10:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Do you mean the difference between RedHat with SELinux enabled, and RedHat without SELinux enabled? SELinux isn't a distro, it's a kernel module... – CaptJak Sep 22 '16 at 16:43
  • Yes. Can you please explain – shadee Sep 22 '16 at 16:55
  • You can also check out the docs: access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/… – CaptJak Sep 22 '16 at 17:24
  • This is a very broad question. You can not easily say if X is more secure than Y. Perhaps you could edit and elaborate a bit on what you are using it for and what kind of specific threats you want to mitigate against? – Anders Sep 22 '16 at 20:19
0

Just go with the SELinux enabled, it doesn't break anything but adds plenty of security features.

By default, all network processes are sandboxed, it also can sandbox desktop apps as well.

Basically working with SELinux is easy, for example:

  • When you enable SELinux, filesystem has to be relabeled during boot, it is possible to relabel folders online as well, this is because files are not labeled when it's off
  • There are "booleans", they can boost your security a lot, you can disable "ptrace" for example or access to /proc and /sys for all non-root users
  • You can fix issues if any with custom applications by using "audit2allow" with the audit.log
  • you can use sandbox command to sandbox scripts
  • there are GUI tools in Fedora to manage SELinux policies

There are two things which are very beneficial:

  • sandboxed processes will not be able to read and write files if someone manages to inject code
  • it may prevent some kernel exploits from working especially if you harden it via "booleans". Kernel exploit would normally bypass SELinux.

There are also other security features in Linux like Capabilities, ACLs, cgroups.

Not the answer you're looking for? Browse other questions tagged or ask your own question.