0

A few days ago I ran into a big problem and asked it here and I found out that selinux was the cause of that. I have some virtual and physical machines with CentOS 6.7 or 6.9 as OS. They all have databases and I want to disable selinux on them, but i'm not sure if disabling it would effect my databases or not. I wanted to know what happen if I disable selinux to check if it has any bad effects on my system or not. What exactly does selinux do and what happens when it is disabled? Can I disable it without reboot, or is just restarting network or other services is enough?

ctrl-alt-delor
  • 27,993
BlackCrystal
  • 756
  • i can't test on them because they support really important services. i have virtual machine on my system that sometimes i use them for test but in this case they are useless because i want to know effects when system is under heavy load of requests from different applications, users and .. – BlackCrystal Feb 23 '19 at 08:47
  • I am not clear. Creating test machines is a good pratice. – Rui F Ribeiro Feb 23 '19 at 09:41
  • SELinux was not the cause of your previous issues, strictly speaking. – Kusalananda Feb 23 '19 at 09:42
  • @Kusalananda why it wasn't? – BlackCrystal Feb 23 '19 at 09:49
  • 2
    @BlackCrystal It's like saying "the permissions were the cause for me failing to delete that file" (the real cause here is executing rm as the wrong user). I'm just shifting the blame from something that can't really be blamed, to the behaviour that made the operation fail (which is something you can do something about). It's just me doing a bit of psychology on a Saturday morning. Don't mind me. – Kusalananda Feb 23 '19 at 09:53
  • 2
    Disabling SELinux may reduce the security of your databases by allowing an attacker to read or write to it without authorization. – Jeff Schaller Feb 23 '19 at 10:25
  • 1
    Copy the system configurations to a test machine, and test. No need to copy the data of the database services, script creation of lots of similar entries. – user2497 Feb 24 '19 at 13:18

2 Answers2

2

Side effects are that additional access restrictions of SELinux are not used anymore. Most of the time, when software is operating normally, there isn't expected to be anything different (usual access control mechanisms are preventing unintended access before SELinux is involved).

However, you should consider investigating the cause of the issue and fixing it (might be due incorrect file labels etc.; impossible to tell without precise details available in logs). Even if you decide to disable SELinux, it is possible to disable the policy module (see semodule) causing the issues or setting the problematic domain in permissive mode (rules are not enforced but are still logged, see semanage-permissive).

sebasth
  • 14,872
  • 1
    I prefer to have them disabled them having them generating logs – Rui F Ribeiro Feb 23 '19 at 09:43
  • @RuiFRibeiro And this is why optional security measures are no security measures. – Kusalananda Feb 23 '19 at 10:37
  • 1
    @RuiFRibeiro It is possible to disable a SELinux policy module. Afterwards there should not be any related SELinux log messages as the service runs in unconfined domain. This still allows leaving the rest of SELinux policy in place (how useful it is not so clear). One clear advantage is that should SELinux be enabled again some later time, the configuration is likely much easier. – sebasth Feb 23 '19 at 12:08
0

There can be side effects from disabling the security theater that is selinux (watch exploit after exploit for Linux and ask where selinux is (one CVE exploits sudo compiled with selinux--thanks for holding the door, selinux) and then discover that selinux is helpfully preventing BIOS passwords from being set on lab machines, which was the final straw for selinux for me); in particular KVM virt servers on Centos Linux 7 that host virts that were built with selinux enabled will fail to start those virts after selinux is disabled (setting security_driver="none" did not help), so after wasting yet more time on selinux I ended up with selinux disabled on almost everything, but set to enabled-but-permissive on the virt servers where virts where setup when selinux was enabled. There will likely be other such edge cases and gotchas; selinux was disabled without incident for some mysql and postgresql database servers, but we're not doing much complicated with those database servers.

thrig
  • 34,938