All,

Good morning. The system is a firewall box with selinux enabled. For a firewall box is there a significant advantage to a strict vs a targeted policy? All local users are 'fully trusted', ie they are me. Which policy would be most effective at preventing an external attack?

- Dan

Strict has the higher security, but is more awkward to use. You can read more here.

For a firewall box is there a significant advantage to a strict vs a targeted policy? All local users are 'fully trusted', ie they are me.

Building on Macemoneta's comments: the difference between the "targeted" and "strict" policy is that with "strict" everything is subject to the policy, confined to a domain. Nothing runs without rules and which means you have to explicitly allow processes to run. By definition a firewall is an single purpose appliance which means no daemons like MTA, DNS and sure as hell no FTP (OK, except your admin SSH on the LAN side or through OOB). If that is your definition too you would have less problems a) closing "regular" loopholes and b) implementing the "strict" policy (because you just don't run a darn thing ;-p).

The "targeted" policy is what you'd call "hard on the outside and chewy on the inside". "Targeted" means that only a set of network-facing daemons run under a restrictive policy. Any processes that don't have a policy and the rest, including root, run in the "unconfined" domain as if SELinux wasn't enabled. If you would have a firewall that runs daemons that aren't covered by a policy only the rules for the "unconfined" domain are in place (about none). If you run daemons that are covered by a policy a transition to another domain, say "unconfined", should be possible since their policies aren't backed by more restrictions (I'm not that far into SELinux (yet) to provide a good, nasty example).

In short: if the box is a "true" firewall then running "strict" will not pose problems that can't be addressed.


Which policy would be most effective at preventing an external attack?
Prevention in the first place means host and network hardening.
IMNSHO that should be done before deciding (and regardless of) which policy you are going to run.