1. SELINUX - Introduction

SELINUX

Introduction:
Security-Enhanced Linux (SELinux) is a security architecture integrated into the 2.6.x kernel using the Linux Security Modules (LSM). It is a project of the United States National Security Agency (NSA) and the  SELinux community. SELinux integration into Red Hat Enterprise Linux was a joint effort between the NSA and Red Hat.It provides essentially the kernel firewall. Typically all OS runs with a discretionary access control mechanism(DAC). This means the process will be running with the respective user privilages. Also means a user on the system has all discretion for providing access to resources owned by the perticular user. However in Mandatary Access Controll system (MAC) the security admin is responsible for defining the policies access/restrictions the subject to object access. It involves the labeling subjects and objects.

     SELinux provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel. Under standard Linux Discretionary Access Control (DAC), an application or process running as a user (UID or SUID) has the user's permissions to objects such as files, sockets, and other processes. Running a MAC kernel protects the system from malicious or flawed applications that can damage or destroy the system.SELinux defines the access and transition rights of every user, application, process, and file on the system.  SELinux then governs the interactions of these entities using a security policy that specifies how strict or lenient a given Red Hat Enterprise Linux installation should be. On a day-to-day basis, system users will be largely unaware of SELinux. Only system administrators need to consider how strict a policy to implement for their server environment. The policy can be as strict or as lenient as needed, and is very finely detailed. This detail gives the SELinux kernel complete,granular control over the entire system.

The SELinux Decision Making Process:
When a subject, (for example, an application), attempts to access an object (for example, a file), the policy enforcement server in the kernel checks an access vector cache (AVC), where subject and object  permissions are cached. If a decision cannot be made based on data in the AVC, the request continues to the security server, which looks up the security context of the application and the file in a matrix. Permission is then granted or denied, with an avc: denied message detailed in /var/log/messages if permission is denied. The security context of subjects and objects is applied from the installed policy, which also provides the  information to populate the security server's matrix.

SELINUX DAC / MAC CONCEPTS
 
3 common access control models:

    1. Discretionary Access Control (DAC)
                    This is the default model. Users has the rights to grand or deny access the objects.
 Major Problems with the DAC based system:

• These are prone to malware and malicious softwares.
• Setuid or setgid files are vulnuerable when a daemon compramises and gains the access.
•  Access to all objects in the system is based on the identity of the user
•  Default policy is liberal to access the objects

    2. Mandatory Access Control (MAC)-SELINUX
                     This is implemented by Selinux.
Benefits using the MAC model

•  MAC requires more system administration/experties
•  Some level of object oriented knowledge is required to configure. The objects in the system is divided in to 2

1. Subjects - users & process
2. Objects  - Files on the system (test/binary/sockets/named_pipes etc)

• Offers more granular/fine control of security. This means the ability to restrict at very lower level of  access to the objects.(eg:- read/write/entering to a directory,lock a file, access a different contex area with in the memmory etc)

    3. Non-Discretionary Access Control (nDAC)
                       It is almost like a hybrid between DAC & MAC.

• Administrator defines the DAC control for entire system