SELinux

This video aims to answer most people's questions about SELinux and should they disable it or how it works or if it's interfering with a program that you've installed.

So let's start out.

There's basically three basic options for SELinux.

There's enforcing, permissive, and disabled.

And by default, Fedora, CentOS, and Red Hat all come with it enforcing.

This is actually a good thing as most programs are compatible with SELinux.

However, if you're downloading a program and running to some issues, there's a possibility it could be SELinux interfering with it.

So I'm going to break down the commands and show you my terminal and how you'd go about troubleshooting that, modifying it, and also moving forward or even changing it to disabled or permissive should you want to monitor what that program is doing or if it's from an unknown source.

But to a new user, this is going to be annoying.

SELinux requires profiles and sandboxing to make sure apps can access parts of the system.

And you're going to be like, oh, crap, I'm running sudo, but it's not allowing this app through.

What's going on? Well, that's probably SELinux in enforcing mode.

I don't care too much about SELinux.

So, you know, I'm not going to say this out loud.

Well, I'll just go ahead and say it.

I just put it either in permissive or disabled because I don't really care too much about SELinux.

In this video I go over how to set up and configure AppArmor so you can create profiles for any custom scripts or programs you may be using.

AppArmor is a Debian-based alternative to SELinux.

SELinux is prevalent in Red Hat, CentOS, and Fedora systems.

So AppArmor basically allows you the ability to restrict access to certain applications, scripts, or programs to only do certain things or only allowed parts of the system access to that program.

So this is a really great thing.

Now, if it is stopped, make sure you enable it by instead of status, you'd put enable and hit start to go ahead and start this service if it is disabled on your system.

Likewise, if you wanted to completely disable app armor here, you can actually type system control disable.

So there's the basics of the actual service that does deviate a little bit from SELinux.

And it is great and it's enabled by default, but sometimes you can install some packages and they don't work quite right or they crash or whatnot.

Usually that means the developer didn't take the time to make it, SELinux compatible per se.

So a lot of times you have to go in and set all those settings by yourself.

You'd set SELinux to permissive and then check your logs and then set that program properly.

But I don't wanna get too far into that.

I'm gonna make a separate video over Security Enhanced Linux.

General hardening principles always apply here.

Defense in depth, the principle of least privilege, and implementing mandatory access controls like SELinux or AppArmor.

Crucial tools.

They ensure that even if a process is compromised via a zero day, its blast radius is contained by strict policies defining what files or network ports it can even access.

I don't consider this a secure desktop.

I take Fedora and I bastardize it in the way that I am disabling SELinux and putting it either in permissive mode or just disabling it altogether because I don't want to be making profiles for my programs to sandbox them.

I want it to run wild.

because a lot of times I am using an agent to go ahead and build out like I'm redoing the launcher here, which we'll go ahead and install this here in a second.