23

How does Ubuntu implements SELinux...? what are the pacakges(modules) involved in implementation of SELinux on Ubuntu

Chinmaya B
  • 5,602
  • 6
  • 24
  • 43

2 Answers2

22

How does Ubuntu implements SELinux...?

selinux is not installed or enabled by default. We use apparmor by default. The Ubuntu wiki page for SELinux even claims ...

Warning

The Ubuntu-specific "selinux" and "selinux-policy-ubuntu" packages documented here have not received much attention since Karmic, and appear to be effectively broken in Precise.

If you wish to use SELinux in Ubuntu, the "selinux-basics" and "selinux-policy-default" packages from Debian are still being actively maintained. Documentation relevant to those packages can be found at http://wiki.debian.org/SELinux

but also contains instruction on how to install it:

SELinux in Ubuntu

SELinux can be enabled in Ubuntu by installing the "selinux" meta-package, which will make the needed changes to the system, and install the Tresys policies for Ubuntu:

sudo apt-get install selinux

After installation, you will be prompted to reboot the system to label and activate SELinux.

But it might be smarter to install the debian packages manually...

What are the packages(modules) involved?

nescius
  • 5
  • 2
Rinzwind
  • 293,910
  • 41
  • 570
  • 710
  • thanx a lot.... – Chinmaya B Jun 10 '14 at 12:53
  • do you mean that ubuntu is safe enough without using SELinux because of app armour is preinstalled on it?? – Chinmaya B Jun 10 '14 at 13:10
  • 1
    Ubuntu installs itself as safe as possible. apparmor is a tool for that and yes, you basically do not need selimux (apparmor is an alternative of selinux (there are more: tomoyo is another one)). – Rinzwind Jun 10 '14 at 13:13
  • 3
    If you wist to use selinux, I highly advise you use Fedora. selinux is maintained in Fedora, active by default, and there are a greater number of tools to manage selinux, both graphical and command line. If you wish to use Ubuntu, as suggested, use Apparmor. both tools have a bit of a learning curve and both have advantages and disadvantages. – Panther Jun 10 '14 at 15:23
  • A good high-level comparison of AppArmor vs SELinux: https://security.stackexchange.com/questions/29378/comparison-between-apparmor-and-selinux On that basis, it may not necessarily be a bad idea to stick with AppArmor... – sxc731 May 31 '17 at 10:52
3

I believe you have to remove apparmor before installing SELinux:

sudo apt-get remove apparmor

According to the SELinux wiki page:

Starting with Hardy Heron SELinux has been integrated into Ubuntu and can be installed via apt.

Install the selinux package:

sudo apt-get install selinux

Change the SELinux mode in /etc/selinux/config (optional):

  • Enforcing

    sudo sed -i 's/SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

  • Permissive

    sudo sed -i 's/SELINUX=.*/SELINUX=permissive/' /etc/selinux/config

Reboot

During shutdown all of the files on the system will be labeled. This may take some time depending on how many files you have and disk speed.

A search using apt-cache search turns up these packages:

postgresql-contrib-9.4 - additional facilities for PostgreSQL
ruby-selinux - Ruby bindings to SELinux shared libraries
checkpolicy - SELinux policy compiler
debian-handbook - reference book for Debian users and system administrators
joe-jupp - reimplement the joe Debian package using jupp
jupp - user friendly full screen text editor
libseaudit-dev - Security Enhanced Linux audit message parser development
libseaudit4 - Security Enhanced Linux audit message parsing library
libsefs-dev - Security Enhanced Linux file context management development
libsefs4 - Security Enhanced Linux file context management
libsetools-java - SETools Java bindings (architecture-independent)
libsetools-tcl - SETools Tcl bindings
libtomoyotools3 - lightweight Linux Mandatory Access Control system - library
policycoreutils - SELinux core policy utilities
python-selinux - Python bindings to SELinux shared libraries
python-semanage - Python bindings for SELinux policy management
python-sepolgen - Python module used in SELinux policy generation
python-sepolicy - Python binding for SELinux Policy Analyses
python-setools - SETools Python bindings
ruby-semanage - Ruby bindings to for SELinux policy management
selinux - Security-Enhanced Linux runtime support
selinux-basics - SELinux basic support
selinux-policy-default - Strict and Targeted variants of the SELinux policy
selinux-policy-dev - Headers from the SELinux reference policy for building modules
selinux-policy-doc - Documentation for the SELinux reference policy
selinux-policy-dummy - Empty Security-Enhanced Linux policy (dummy package)
selinux-policy-mls - MLS (Multi Level Security) variant of the SELinux policy
selinux-policy-src - Source of the SELinux reference policy for customization
selinux-policy-ubuntu - Security-Enhanced Linux Reference Policy
selinux-policy-ubuntu-dev - Security-Enhanced Linux Reference Policy Development Headers
selinux-policy-ubuntu-doc - Security-Enhanced Linux Reference Policy Documentation
selinux-utils - SELinux utility programs
setools - tools for Security Enhanced Linux policy analysis
setools-gui - GUI tools for Security Enhanced Linux policy analysis
mchid
  • 42,315
  • 7
  • 94
  • 147