What is the state of SELinux and are there alternatives?

Question

I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different stack, etc.

I thought about SELinux as a mean to prevent a propagation of an intrusion from one of those machines; if a hacker finds an exploit in the web server, I don't want him to be able to read /etc/shadow file or connect to NFS, or... whatever.

Unfortunately, I'm using Debian, which doesn't seem to have a very good support of SELinux. I tried it for half an hour, encountered lots of problems at installation, including the missing selinux-policy-default, and found half a dozen resources telling that Debian and SELinux don't play well together.

Technically, nothing prevents me from moving to CentOS, so my question is not what should I do to solve the problems I've encountered.

My question is rather this. Since Debian is one of the most popular distributions for the servers and, I suppose, is used in environments which are much more sensitive than mine, and since nobody seemed to have an incentive to “fix” SELinux to work flawlessly, doesn't this indicate that SELinux is not that popular in the first place?

If it's actually unpopular, what are the more popular alternatives?

Or am I overestimating the importance of SELinux, and correctly configured firewall and file permissions are all that's needed?

Answer 1

SELinux provides a more granular permissions system based on the concept of Mandatory Access Control (MAC) and Role-Based Access Control (RBAC). It's much more flexible and capable than the typical Discretionary Access Controls (POSIX Permissions) and Linux Capabilities, but it really requires a lot of effort to configure and manage correctly.

Since you asked specifically about Debian, I'll point you to AppArmor, which is also a Kernel Security Module, and more frequently (in my experience) used with Debian and Ubuntu. I've configured both SELinux and AppArmor, and find AppArmor policies easier to understand.

That being said, both of them were developed in an era where it was "normal" to have lots of users using single hosts (i.e., have shell login accounts) or to run many services from a single server. Today, isolation is more commonly achieved by running a single service on each server (typically a VM) or using other sandbox technologies.

Both SELinux and AppArmor have a steep learning curve, and misconfiguration will either leave them useless or break legitimate use of the service. You don't need to look much further than the volume of advice on the internet describing how to disable SELinux to realize it's not very popular.

Unless you're running shared hosting or other configurations that have multiple users operating on a single (virtual) server, I would put security effort into other spaces, such as patch management and network segregation.

Answer 2

SELinux is a well written and stable bit of software. However:

1. it doesn't actually do anything. For that you need a policy.
2. SELinux was designed to provide a permissions model for a new operating system - but has been bolted back into Linux which already had a fairly sophisticated security system - so now you have 2 (or more)
3. you're probably going to have to change the policy every time you add software - so I would strongly recommend NOT using a distro which is not designed around a well defined policy (i.e. Redhat and derivatives are the only game in town).
4. sadly, even the RedHat policy is not well documented

IMHO, there's no empirical evidence of SELinux actually improving security of a system - and it breaks so much stuff out of the box, that it requires a lot of effort to configure and maintain which would be better spent elsewhere.

I thought about SELinux as a mean to prevent a propagation of an intrusion from one of those machines; if a hacker finds an exploit in the web server, I don't want him to be able to read /etc/shadow file or connect to NFS, or... whatever.

If, given an exploit of your webserver, the attacker can read /etc/shadow then then you need to spend a lot of time configuring your server with conventional tools - your security is very broken and SELinux is not going to fix that.