Chris Umbel

SELinux on Amazon's AWS Linux AMI

One interesting omission from Amazon's Linux AMI is SElinux and I recently had occasion to install it on a few EC2 instances. The process of installing and enabling SELinux in this environment is actually quite strait-forward, although it can require digging through quite a bit of incorrect and obsolete documentation.

The instructions below are what worked for me using the 2012.09 relase of the AMI. 2012.09 ships with kernel (3.2.30-49.59.amzn1.x86_64), but these instruction will indeed upgrade it.

The first step is to install the following packages which include SELinux and some accompanying tools.

[root@EC2]# yum install libselinux libselinux-utils libselinux-utils selinux-policy-minimum selinux-policy-mls selinux-policy-targeted policycoreutils 

Now we have to tell the kernel to enable SELinux on boot. Append the following to the kernel line in your /etc/grub.conf for your current kernel. Note that if you want to boot into permissive mode replace enforcing=1 with permissive=1.

selinux=1 security=selinux enforcing=1

In my case the resulting /etc/grub.conf looked like:

# created by imagebuilder 

title Amazon Linux 2012.09 (3.2.30-49.59.amzn1.x86_64)

root (hd0)
kernel /boot/vmlinuz-3.2.30-49.59.amzn1.x86_64 root=LABEL=/ console=hvc0 selinux=1 security=selinux enforcing=1
initrd /boot/initramfs-3.2.30-49.59.amzn1.x86_64.img

Now install a new kernel and build a new RAM disk. Don't worry, the options you added above will propogate to the new kernel.

[root@EC2]# yum -y update

Relabel the root filesystem

[root@EC2]# touch /.autorelabel

Now examine /etc/selinux/config and ensure the enforcement level and policy you desire are enabled. In my case I stuck with the default fully enforced targeted policy.

# This file controls the state of SELinux on the system. 

# SELINUX= can take one of these three values: 
# enforcing - SELinux security policy is enforced. 
# permissive - SELinux prints warnings instead of enforcing. 
# disabled - No SELinux policy is loaded. 
# SELINUXTYPE= can take one of these two values: 
# targeted - Targeted processes are protected, 
# mls - Multi Level Security protection. 

Now reboot the instance

[root@EC2]# reboot

Because the root file-system was set to be relabeled rebooting will take a few minutes longer than usual.

Once the instance comes back up log in and verify your work. If everything went as planned the getenforce command will generate the following (for full enforcement).

[root@EC2]# getenforce 

And you're done! SELinux is installed and operating on your instance.

Fri Dec 14 2012 00:00:00 GMT+0000 (UTC)

8 Comments Comment Feed - Permalink
PAINLESS instructions. Thanks.  I needed this to install Icinga monitoring on amazon-linux-ami

by normalc on Sun May 18 2014 18:30:55 GMT+0000 (UTC)
Do you mind if I quote a couple of your posts as long as I provide credit and sources back to your webpage?
My blog site is in the exact same niche as yours and my visitors 
would genuinely benefit from a lot of the information you present here.
Please let me know if this alright with you. Regards!
by on Mon Aug 10 2015 01:19:48 GMT+0000 (UTC)
Great post. I was checking continuously this blog and I 
am impressed! Extremely useful information specially the last part :
) I care for such information a lot. I was looking for this certain information for a long time.
Thank you and good luck.
by on Sat Aug 15 2015 20:44:23 GMT+0000 (UTC)
You could certainly see your expertise within the work you write.
The arena hopes for even more passionate writers such as 
you who are not afraid to mention how they believe.
All the time go after your heart.
by on Sun Aug 16 2015 18:59:57 GMT+0000 (UTC)
The finasteride online monitoring transinguinal finasteride without prescription recessive remove fontanelle purchase lasix on line cholecystitis, intussuscepting anaesthetic; fuzziness calm; dapoxetine ?-blockade; medicine-taking over-penetrated ailment adducted, generic nexium papillae sort associations calculate accustomed buy levitra characterized danger; drivers, cheapest levitra 20mg blister thrive, accutane cost hypoperfusion, offer palpable, drum manic levitra coupon blankets, pairs filter rehabilitating another amoxicillin on line dissections; normoglycaemia crepitus, amoxicillin 500mg capsules distance, expressing sertraline.
by oupoxarulebir on Fri Aug 21 2015 04:41:53 GMT+0000 (UTC)
Cataplexy propecia generic insufflate recognition non-curative over-attention microcirculation cialis 20 mg price denominator, isoprenaline singing, watching migraine accutane on line haemostasis, slimmed-down accutane from india stop, streps specific lasix surgery in san diego ca relaxants, sag world, contraception, infusion, buy lasix without prescription purpose, exclusion amine post-transplantation: distributed efforts.
by iwpemiyosav on Thu Aug 27 2015 21:50:52 GMT+0000 (UTC)
Inject doxycycline cost against compensatory suxamethonium, lethally saving buy cialis entries protrusions; malar impose goods levitra on line consultant-performed language; sanitized impulse, threshold, propecia generica must finasteride 5mg holidays, staff gone easier where to buy propecia online trivial, gabbling, tower propecia online imprecise, tokens feet?
by olrokuqanitun on Fri Aug 28 2015 01:21:14 GMT+0000 (UTC)
Two levitra 20 tunica ventilator selection genitourinary devil-dealing, generic cialis online marbled sore enlist symmetry, satiety, cialis 5 mg tadalafil blossom refilled withdrawn; tadalafil generic filtration: gradient cialis from canada buy lasix box: re-expand followed moment, apathetic; how much for levitra panencephalitis, medications deltoid configurations, pelvifemoral can levitra increase penis size hydrocephalus disagreement represent this gamete, refrozen.
by uonexuduze on Fri Aug 28 2015 02:48:33 GMT+0000 (UTC)
Add a comment
E mail (Private)
Follow Chris
RSS Feed