news
Red Hat on Fedora Stretgy and Blacklisting in SELinux
-
Fedora Project ☛ Fedora Community Blog: Strategy 2028 Update
As we head into Flock, It’s time again to talk about #strategy2028 — our high-level plan for the next few years.
Since it’s been a while since I’ve given an update, I’m going to start at the top. That way, If this is new to you, or if you’ve forgotten all about it, you don’t need to go sifting through history for a refresher. If you’ve been following along for a while, you may want to skip down to the “Process section”, or if you just want to get to the practical stuff, all the way down to “Right Now”.
-
LWN ☛ Strategy 2028 update (Fedora Community Blog)
Outgoing Fedora Project Leader Matthew Miller has posted an update on Fedora's high-level plan through 2028:
[Fedora] Council members identified potential Initiatives that we believe are important to work on next. -
Red Hat ☛ How SELinux deny rules improve system security
SELinux userspace release 3.6 introduces deny rules. SELinux is designed as an additional layer of system security. SELinux policy defines the access and operations (e.g., read or write) allowed for certain resources. SELinux stops all access unless allowed by policy.
Before the SELinux 3.6 userspace version, it was not possible to drop any access already allowed in the base SELinux policy or in a module. When you wanted to remove access, you had to rewrite the base policy or the module. This would mean maintaining your own policy or module and overriding the distribution policies. While it’s feasible, it costs resources and could be error-prone, because you would need to merge distribution changes with your own.
How deny rules work
The changes in the latest SELinux userspace release 3.6 introduced support for
denyrules. They are documented in Access Vector Rules: "Remove the access rights defined from any matching allow rules. These rules are processed beforeneverallowchecking."Rule definition:
(deny source_id target_id|self classpermissionset_id ...)A
denyrule is like aneverallowrule, except it removes permissions rather than reporting errors.Let’s consider the following use cases.