On Oct 30, 2012, at 9:15 AM, Vincent Passaro <vince.passaro(a)fotisnetworks.com>
wrote:
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Spencer R.
Shimko
Sent: Tuesday, October 30, 2012 5:45 AM
Hi Vince,
Care to elaborate on "MOST applications aren't written to work well with
SELinux"? This was common FUD spread years ago both other security camps and I am
certainly surprised to see you bring it up these days. It was FUD then, it is FUD now.
Thanks,
--Spencer
A quick list off the top of my head : HPSA, Oracle DB, Oracle RAC, Oracle Application
Suite / SoA Portal, Avaya Products, Calegra Products, and HP Jabber Chat Server.
A quick look at that list and a little help from Google indicate at least several in that
list are written/compiled in such a way that they contain text relocations. Without
going into the specifics I'll just say this is side-effects that have a negative
impact the security posture of a system. The appropriate thing to do is address it in the
code. Unfortunately this doesn't always happen.
Given the security impact of text relocations SELinux can and does prevent it from
happening unless the libraries have "exceptions" added to the SELinux policy.
That doesn't mean the application won't work well. Adding exceptions can be done
with a single command but instead vendors choose to provide people with instructions on
disabling SELinux. In the end you're right in so much that *some* applications may
not work until this command is run. In my experience the number of applications that need
this is relatively small. On system running with unconfined users (targeted policy) most
applications work just fine. The real fix lies in the application which should be
updated and/or compiled to avoid this security issue.
There are other security mechanisms that one can use on Linux that don't compose well
with SELinux. In those scenarios one mechanism must be chosen over the other. I
don't see anything in that list that falls into this category.
I do believe we have wandered off topic a bit. As Steve said elsewhere in the thread, it
has been changed to a Cat II.
Thanks,
--Spencer
--Vince