Workgroup:SELinux

From NixOS Wiki

Selinux

Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM).

Config Sample

 boot.kernelParams = [ "security=selinux" ];
 # compile kernel with SELinux support - but also support for other LSM modules
 boot.kernelPatches = [ {
        name = "selinux-config";
        patch = null;
        extraConfig = ''
                SECURITY_SELINUX y
                SECURITY_SELINUX_BOOTPARAM n
                SECURITY_SELINUX_DISABLE n
                SECURITY_SELINUX_DEVELOP y
                SECURITY_SELINUX_AVC_STATS y
                SECURITY_SELINUX_CHECKREQPROT_VALUE 0
                DEFAULT_SECURITY_SELINUX n
              '';
        } ];
 # policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus.
 environment.systemPackages = with pkgs; [ policycoreutils ];
 # build systemd with SELinux support so it loads policy at boot and supports file labelling
 systemd.package = pkgs.systemd.override { withSelinux = true; };

Links