Autonomía digital y tecnológica

Código e ideas para una internet distribuida

Linkoteca. SELinux

What’s The Difference Between POSIX ACLs and SELinux?

Imago voragine.net
• , , , ,

An access control list (ACL) is a more advanced approach to security. It can implement the user/group/anonymous user approach with the basic rwx attributes but typically implementations do much more. In the case of Linux, the POSIX access control list (ACL) is usually supported.

Mandatory Access Control (MAC) is a policy-based approach that provides even more control over how security is implemented and controlled. It extends past the basic access controls of DAC and ACL to allowing an administrator to have fine grained control over what changes users can make. With DAC, a user simply needs write access to be able to change the attributes of a file or directory. The ability to create a file requires write access to the directory a file will be created in.

MAC systems normally provide the ability to specify access attributes as well as the ability to see and modify those attributes. The ability to create and delete files or directories can provide fine grain control. In addition, files and directories can have attributes that can be matched against rules that can control where and how data can be used.

MAC systems usually extend their control beyond the file system. This allows network interfaces, ports and other logical and physical devices to be monitored. This approach can even extend to services such as a system’s firewall. An application can be limited to the ports and interfaces they are allowed to use as well as the files, directories and other resources such as applications they have access to. SELinux is the MAC normally associated with Linux but there are others as well.

Who is using chroot with php-fpm? Is it worth it?

Imago voragine.net
• , , , ,

I don’t use chroot, but the default setup for modern versions of FPM already compartmentalizes everything adequately for example, the private /tmp directory. I agree with others that chroot is an outdated way of doing things.

Also, I use SELinux…yet another way of achieving many of the same goals of chrooting. I’d highly recommend setting up SELinux if you are not already using it. If you’re concerned enough about security that you’d even think of chrooting php-fmp, you probably want to set up SELinux and have it on «Enforcing» (it’s useless on «Permissive» mode, that’s really only suitable for the configuration phase of test servers.) Not only will it provide security with PHP, but you get a whole bunch of other security benefits of it.

I have done some pretty sophisticated things with a web server under SELinux, requiring me to manually change a number of policies, and while I have had a few prolonged sessions of frustration, maybe 3-4 hours at a time of banging my head against the wall trying to get the permissions set up properly, it is totally worth it. It’s all up-front work, and once you learn how to do it it’s very easy.