What is SELinux

SELinux is a security feature originally developed by the United States National Security Agency (NSA) that enforces strict access policies. It can protect your system from being compromised by limiting what processes and applications can access, even if they are running with root privileges.

Why Use SELinux

Installing SELinux on Ubuntu VPS

Unlike some Linux distributions where SELinux is enabled by default (e.g., Fedora or CentOS), Ubuntu uses AppArmor by default. However, you can install and enable SELinux on Ubuntu manually. Here’s how you can do that.

To install SELinux on your Ubuntu VPS, first ensure that your system is up to date:

Then, install the necessary SELinux packages:

This will install SELinux utilities and basic components required to manage and configure SELinux policies.

After installation, initialize SELinux using the following command:

This command prepares your system for SELinux use by setting up necessary configurations.

SELinux can operate in several modes:

To configure SELinux in enforcing or permissive mode, edit the SELinux configuration file:

You should see a line similar to:

Change it to enforcing or leave it as permissive for testing purposes. In enforcing mode, SELinux policies are applied, while permissive mode will only log policy violations.

After making changes, save and exit the file. Then, reboot your VPS to apply the SELinux configuration:

Once your VPS has rebooted, you can check the status of SELinux with the following command:

If SELinux is properly configured, you will see its status as enabled and its current mode (enforcing or permissive).

Managing SELinux Policies

SELinux enforces security policies that define what resources processes can access. These policies can be customized to fit your security needs. By default, SELinux ships with predefined policies, but you can create custom policies as well.

You can list the current SELinux policies applied to processes and files using the ps and ls commands with their respective SELinux options:

To view SELinux security contexts for running processes:

To view SELinux security contexts for files and directories:

The security context consists of user, role, type, and level. Each component defines permissions and controls how processes and files interact.

Before configuring a policy, it's often useful to switch SELinux to permissive mode to test whether applications will function without being blocked by SELinux policies:

This puts SELinux in permissive mode temporarily, and violations will be logged instead of enforced.

For this example, let's assume we want to secure the Apache web server with SELinux policies. First, install Apache if it's not already installed:

Start the Apache service:

Now, let’s check the security context of the Apache executable:

SELinux assigns a type to each resource, and processes are restricted to accessing only resources of specific types. If Apache isn’t working as expected, you can troubleshoot with SELinux logs.

When SELinux denies an action, it logs the event. You can view SELinux-related logs to identify policy violations:

Each denial event will have details about the process that was denied access and why.

For example, if Apache tries to access a directory it’s not allowed to, you might see an AVC (Access Vector Cache) denial in the logs.

If Apache is being blocked from accessing specific files or directories, you can create a custom policy module to allow it. Here’s how you can generate a policy module to allow access.

1- Generate a Policy Module:

Use the audit2allow tool to generate a custom SELinux policy based on the denials in the logs:

2- Install the Custom Module:

Once the policy module is created, install it with:

This policy will now allow Apache to perform the actions that were previously blocked by SELinux.

Once you’ve verified that everything works as expected, you can switch back to enforcing mode:

Example: Securing a Web Application with SELinux

Let’s look at a real-world example of using SELinux to secure a web application running on Apache.

Create a new directory for your web application:

If Apache is unable to serve files from this directory due to SELinux policy violations, you can view the log and create an appropriate policy.

Use chcon to change the SELinux security context of the directory to a type that Apache is allowed to read:

Now, try accessing the web application via the browser. If SELinux is configured correctly, Apache should serve the files without any permission issues.

SELinux is a powerful tool that adds an additional layer of security to your Ubuntu VPS. Although it’s not enabled by default in Ubuntu, you can install and configure SELinux to enhance the security of your applications by enforcing strict access policies. With the steps outlined in this guide, you can install SELinux, create custom security policies, and protect your system from unauthorized access, even in the case of vulnerabilities in applications.