Few things in the Linux world evoke a strong reaction like SELinux, the security enhancement for Linux. At LinuxCon, Susan Lauber hopes to soften that response and show people the light. In her talk, SELinux—it's all about the labels, Lauber will teach SELinux basics and describe why it's a must-run on your systems.
In this interview, she tells us more.
How did you get involved in providing SELinux training?
From my early days of PC support and system administration, I had an interest in the security aspects of computing. Once I began teaching various network operating systems that interest became even stronger. I even did my Master's paper on the need for mandatory access controls at an operating system level. That was 9 years ago! As a Red Hat Certified Instructor I jumped on the opportunity to learn and teach all of their security track classes, including the SELinux Administration and Policy Writing course.
SELinux has a less-than-rosy reputation with a lot of people, despite its benefits. Apart from the coloring book, how can SELinux be evangelized?
Many people fear what they do not understand. Giving more and more examples of how SELinux is configured and how it protects—even with default out of box settings—gives more administrators the confidence to keep SELinux in enforcing mode. Additionally, there are a lot of administrators who got a bad taste with the early days of SELinux availability. They should try again! Today, the shipped "targeted" policy works for many people. There is not a lot of need for complex policy writing and plenty of tools for assisting with simple policy modifications. Most changes can actually be made with administration tools and even centrally managed. From the security management side, it is worth noting that having SELinux in enforcing mode, even with the default targeted policy, has prevented damage from a number of exploits. I will have links to several Red Hat Security Blog posts detailing how SELinux mitigated damage in recent and very public zero-day exploits.
What can developers do help make sure their software isn't the reason SELinux gets turned off on a system?
Software developers need to think about security from the early design phases. Not everyone will use software the way it was intended or envisioned. Following cross platform advice such as verifying input, having authentication if necessary, and not being too open in file permissions will also assist in having your application work with SELinux in enforcing mode.
I remember when various toolkits first came out to create Android apps for phones, and new developers would simply check all the boxes to allow for anything they might want to do at some time in the future. I still do not think my solitaire game needs access to my contacts list!
Even default SELinux policies are going to allow things that make sense. If my application is creating web content all I need to do is ensure that that the resulting content has the httpd_sys_content label applied. On the other hand, if my application tries to read and publish the contents of the /etc/shadow file, then I expect SElinux to squash that request.
If the application only reads and writes to files it owns, SELinux should allow that will the default policy, even if the application is running unconfined. There are now a number of SELinux policy writing tools that can assist in creating a policy for your application but it just as likely that you may be able to use an existing policy module with few if any modifications.
What's your favorite part of contributing to open source projects?
Without a doubt, it's the community. As a traveling trainer much of my social life is virtual and open source communities are open 24/7. I can contribute just a little or dive in deep to a specific topic. There is always something new to learn and explore. New ideas come from all over the world and innovation happens at all hours of the day and night. If I don't have the brain cells for new technical content, I can always find information on regional hard ciders or music from any culture I choose.
What are your can't-miss LinuxCon sessions this year?
If you have any interest in containers and security, check out both talks by Dan Walsh. He is a great speaker, the author of the coloring book I reference, and the SELinux man. I heard both presentations at Red Hat summit and they were great.
Rikki Endsley is repeating her Willie Nelson talk from OSCON. I heard great things and I plan to catch that one this time around.
My top technical focus is talks on anything related to security administration but beyond that I have interests in Atomic Host, Kubernetes, and Apache Hadoop. There is a "Securing Big Data at Rest" talk that I am hoping to catch and I am staying in Seattle for the first day of the Linux Security Summit as well.
Speaker Interview
This article is part of the Speaker Interview Series for LinuxCon, CloudOpen, and ContainerCon North America 2015. LinuxCon North America is an event where "developers, sysadmins, architects and all levels of technical talent gather together under one roof for education, collaboration and problem-solving to further the Linux platform."
Comments are closed.