Selinux: NSA's Open Source Security Enhanced Linux

By Xiaoming Chen

The intensive search for a more secure operating system has often left everyday, production computers far behind their experimental, research cousins. Now SELinux (Security Enhanced Linux) dramatically changes this. This best-known and most respected security-related extension to Linux embodies the key advances of the security field. Better yet, SELinux is available in widespread and popular distributions of the Linux operating system--including for Debian, Fedora, Gentoo, Red Hat Enterprise Linux, and SUSE--all of it free and open source. SELinux emerged from research by the National Security Agency and implements classic strong-security measures such as role-based access controls, mandatory access controls, and fine-grained transitions and privilege escalation following the principle of least privilege. It compensates for the inevitable buffer overflows and other weaknesses in applications by isolating them and preventing flaws in one application from spreading to others. The scenarios that cause the most cyber-damage these days--when someone gets a toe-hold on a computer through a vulnerability in a local networked application, such as a Web server, and parlays that toe-hold into pervasive control over the computer system--are prevented on a properly administered SELinux system. The key, of course, lies in the words "properly administered." A system administrator for SELinux needs a wide range of knowledge, such as the principles behind the system, how to assign different privileges to different groups of users, how to change policies to accommodate new software, and how to log and track what is going on. And this is where SELinux is invaluable. Author Bill McCarty, a security consultant who has briefed numerous government agencies, incorporates his intensive research into SELinux into this small but information-packed book. Topics include: A readable and concrete explanation of SELinux concepts and the SELinux security model Installation instructions for numerous distributions Basic system and user administration A detailed dissection of the SELinux policy language Examples and guidelines for altering and adding policies With SELinux, a high-security computer is within reach of any system administrator. If you want an effective means of securing your Linux system--and who doesn't?--this book provides the means.

• Format: Paperback
• Language: English
• ISBN: 0596007167
• ISBN13: 9780596007164
• Release Date: November 2004
• Publisher: O'Reilly Media
• Length: 238 Pages
• Weight: 0.98 lbs.
• Dimensions: 0.7" x 7.1" x 9.2"

Customer Reviews

Great Overview to a Potentially Complex Topic

This book is a great introduction to the topic of SELinux because of the information on its developmental background and lucid description of the objectives, advantages and maintenance of a SELinux system. I would recommend this book to someone who has a firm grasp of basic security concepts and programming principles and is interested in getting exposure to the security enhanced model of Linux.

One of the best on creating a secure Linux system

So what makes Selinux more secure than standard Linux? Primarily it is the implementation of role-based access control, sandboxing, and an audit facility that allows the system to log any attempts to exceed specified permissions. It does all this without conflicting with the normal permissions of Linux. If you are able to access a file through normal discretionary access control then the role-based mandatory access control...

Timely, Accurate and Readable

Bill McCarty's book is all of the above and the requirements have been met for a throughly enjoyable read. You don't have to be a Linux geek to appreciate the security mechanisms that Information Assurance Directorate of the NSA and the myriad of contributors have helped to create. These go way beyond IT systems decisions and at their base level represent good business management practice. The days of using insecure, bloated...

Every Linux person could use this book

Bill McCarty has done a top notch job of explaining Security Enhanced Linux as well as the security model itself. I've attempted so many time to "get it" about SELinux and not until I read this book did it make sense. Bill's organization of the material makes a huge difference. He breaks the subject down into easily understandable chunks. The reader can follow the simple road until everything makes sense. And, SE Linux does...

Excellnet Overview

This book is a must read for beginners exploring the powers of SELinux and trying to setup a custom system. it has all the information needed to give a basic grounding of how everything is organised and how security is incorporqated into the kernel. it deals with the structural as well as the functional organization of the various components involved. although not exhaustive in examples there is a considerable number of'em...