SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP

Spencer R. Shimko sshimko at tresys.com
Tue Oct 30 15:21:09 UTC 2012


On Oct 30, 2012, at 9:15 AM, Vincent Passaro <vince.passaro at fotisnetworks.com> wrote:

> 
> 
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Spencer R. Shimko
> Sent: Tuesday, October 30, 2012 5:45 AM
> 
> 
> Hi Vince,
> 
> Care to elaborate on "MOST applications aren't written to work well with SELinux"?  This was common FUD spread years ago both other security camps and I am certainly surprised to see you bring it up these days.  It was FUD then, it is FUD now.
> 
> Thanks,
> --Spencer
> 
> A quick list off the top of my head : HPSA, Oracle DB, Oracle RAC, Oracle Application Suite / SoA Portal, Avaya Products, Calegra Products, and HP Jabber Chat Server.  

A quick look at that list and a little help from Google indicate at least several in that list are written/compiled in such a way that they contain text relocations.   Without going into the specifics I'll just say this is side-effects that have a negative impact the security posture of a system.  The appropriate thing to do is address it in the code.  Unfortunately this doesn't always happen.  

Given the security impact of text relocations SELinux can and does prevent it from happening unless the libraries have "exceptions" added to the SELinux policy.  That doesn't mean the application won't work well.  Adding exceptions can be done with a single command but instead vendors choose to provide people with instructions on disabling SELinux.  In the end you're right in so much that *some* applications may not work until this command is run.  In my experience the number of applications that need this is relatively small.  On system running with unconfined users (targeted policy) most applications work just fine.   The real fix lies in the application which should be updated and/or compiled to avoid this security issue.  

There are other security mechanisms that one can use on Linux that don't compose well with SELinux.  In those scenarios one mechanism must be chosen over the other.  I don't see anything in that list that falls into this category. 

I do believe we have wandered off topic a bit.  As Steve said elsewhere in the thread, it has been changed to a Cat II.  

Thanks,
--Spencer
> 
> --Vince
> 



More information about the scap-security-guide mailing list