Do you disable SELinux? [closed]

Question

I want to know if people here typically disable SELinux on installations where it is on by default? If so can you explain why, what kind of system it was, etc?

I'd like to get as many opinions on this as possible.

Answer 1

I did, three or four years ago when defined policies had many pitfalls and creating policies was too hard and I had 'no time' to learn. This was on not critical machines, of course.

Nowadays with all the work done to ship distros with sensible policies, and the tools and tutorials that exist which help you create, fix and define policies there's no excuse to disable it.

Answer 2

I worked for a company last year where we were setting it enforcing with the 'targeted' policy enabled on CentOS 5.x systems. It did not interfere with any of the web application code our developers worked on because Apache was in the default policy. It did cause some challenges for software installed from non-Red Hat (or CentOS) packages, but we managed to get around that with the configuration management tool, Puppet.

We used Puppet's template feature to generate our policies. See SELinux Enhancements for Puppet, heading "Future stuff", item "Policy Generation".

Here's some basic steps from the way we implemented this. Note other than the audit2allow, this was all automated.

Generate an SELinux template file for some service named ${name}.

sudo audit2allow -m "${name}" -i /var/log/audit/audit.log > ${name}.te

Create a script, /etc/selinux/local/${name}-setup.sh

SOURCE=/etc/selinux/local
BUILD=/etc/selinux/local

/usr/bin/checkmodule -M -m -o ${BUILD}/${name}.mod ${SOURCE}/${name}.te
/usr/bin/semodule_package -o ${BUILD}/${name}.pp -m ${BUILD}/${name}.mod
/usr/sbin/semodule -i ${BUILD}/${name}.pp

/bin/rm ${BUILD}/${name}.mod ${BUILD}/${name}.pp

That said, most people are better off just disabling SELinux and hardening their system through other commonly accepted consensus based best practices such as The Center for Internet Security's Benchmarks (note they recommend SELinux :-)).