SELinux (Security-Enhanced Linux) 

	Overview
 	-Prototype kernel with enhanced security functionality
	(utilises the LSM(Linux Security Modules) kernel interface.)
	-Made by NSA(National Security Agency), first version released 
	late 2000.
	-An implementation of the FLASK architecture, open source.
	- Improves access handling by incorporating flexible Mandatory 
	Access Control(MAC).


	What is MAC?
	-Idea originally used in military systems.
	-Support  multi-layer security levels.
	-All security policies handled by administrator, NOT users.
	-Able to control which objects (files,memory,IO-devices) 
	subjects(users, programs)  may access. 
	-Security politics and enforcement strictly separated.


	How does SELinux implement this?
	Through FLASK-architecture(simplified):
       		-Every object (file, IO-device) must correspond to a type 
		which determines which processes get access to it.

       		-Every process (user,program) must correspond to one or more 
		domains, which  represents the things a process is allowed 
		to do, on which types.(read,write,exec etc.)

      		 -A process must correspond  to one or or more roles. A 
		role determines	 which domains  can be used by a process. A user 
		can for example be given two roles;  guest, which runs in a 
		domain given minimal rights,  mail-admin, which is given 
		necessary rights to access resources regarding a mail server.
	
		-These properties define a security context, and are 
		encapsulated in asecurity server.The Security server is 
		a separated part of the kernel, and is responsible for taking 
                           security decisions based on the politics defined. An interface is 
                          inserted between the SS and rest of the SELinux kernel. 

 		-The rest of the kernel is responsible for labeling-mechanisms and 
		enforcement based on SS' decisions. 


	In practice
		-Policies must be given by administrator and compiled into the kernel.
	
		-Basic policy syntax(to be inserted into appropriate config-file):

		Adding new user USER  authorized for roles user_r and admin_r:

			user USER roles {user_r adm_r};

		Letting role user_r access  domains  DOMAIN1_t:
 
			role user_r types {DOMAIN1_r};

		Compiling and running SELinux with new policy: 
	
			make load

 		-A lot of known Linux programs have been modified in order to reflect
		 new security attributes from  SELinux. (ls, ps etc.) These modifications
		 usually let users add SELinux-spesific parameters, like  ls -context, which 
		 lists files along with their security context .

		-The security context are outputted as following:  id : role : domain/type.

		-To change role, the command newrole is used.  To illustrate, consider 
		running as user USER, who is authorised 2 roles.
 	
			id
			context=USER:user_r:DOMAIN1 //(security portion of output)
			newrole -r adm_r
			id
			context=USER:adm_r:DOMAIN1 
	 
		-Selinux comes with a number of predefined domain and roles, which
		 satisfies most needs.


 
	Advantages (in a security context)
	-Users can not alter security attributes ( file read,write etc.) on files 
	they own. This prevent users from, deliberately or not,compromising
	 security.


	-Programs do not inherit access-rights from user as in Linux.This means 
	that each program in the system can be restricted to the least of privileges 
	they need. This reduces the potentional damage made by known program 
	exploits(buffer overflow etc.)

	-There is no (by default)almighty root with all access rights, which means 
	that the danger from attacks motivated by gaining root-privileges are
	 minimized into the privileges the hacked deamon owns.


	Disadvantages
              -Relatively complicated setup and maintenance work ie. making policies, 
	 may involve much work on large systems. Not many supporting tools yet 
	 developed.
 
	-Compared to standard linux-kernel: 7% performance drop.  Note: Selinux 
	has not been optimized for speed.
            -The only Linux distribution that supports the SELinux-kernel
              is Fedora Core 2.