NSA SELinux can be turned off in kernel?

kenw232 · 01-26-2014, 09:42 AM

I'm running a slackware 14.1 production server. I compiled my own kernel 3.10.18. I'm seeing a bunch of these in my kernel error log:

[12891.745177] type=1401 audit(1390744778.400:3): SELinux: unrecognized netlink message type=20 for sclass=32
[12891.745177]
[12891.746369] type=1401 audit(1390744778.400:4): SELinux: unrecognized netlink message type=20 for sclass=32
[12891.746369]
[12891.747570] type=1401 audit(1390744778.400:5): SELinux: unrecognized netlink message type=20 for sclass=32
[12891.747570]

I noticed under "Security options" when compiling the kernel there is "NSA SELinux Support". Can this be turned off without impact? Account logins and passwd and PAM will all still work correct? Is there anything I need to know about this? What does it even do? Does it impact ext4 at all?

I actually get those above messages when I run /sbin/ss to see connections and whatnot. It also says
Jan 26 09:43:42 server [ 559.018776] audit_printk_skb: 12 callbacks suppressed

Thanks for any help.

uname -a:
Linux central 3.10.18 #13 SMP Sat Dec 14 15:53:39 EST 2013 x86_64 Intel(R) Xeon(R) CPU E5520 @ 2.27GHz GenuineIntel GNU/Linux

Didier Spaier · 01-26-2014, 10:07 AM

NSA SELinux support is not set in Slackware kernels.

Code:

bash-4.2$ grep SELINUX config-*
config-generic-3.10.17:# CONFIG_SECURITY_SELINUX is not set
config-huge-3.10.17:# CONFIG_SECURITY_SELINUX is not set
bash-4.2$

And AFAIK PAM is not shipped in Slackware.

A bit of advice: when compiling your own kernel on Slackware, first take as a basis a config file provided by Slackware, run make oldconfig, then customize it as need be.

55020 · 01-26-2014, 10:16 AM

Yes it can be turned off without impact. SELinux implements mandatory access control. It is not enabled in Slackware's own kernels.

If you are new to compiling your own kernel, it is generally better to start from a Slackware configuration (which embodies many years of wisdom and experience) and only make changes that you understand, rather than starting with the kernel's defaults (which, frankly, are quite random).

kenw232 · 01-26-2014, 11:34 AM

Great, thanks.