Product SiteDocumentation Site

8. What is New for System Adminstrators

8.1. Security

This section highlights various security items from Fedora.

8.1.1. Security enhancements

Fedora continues to improve its many proactive security features.

8.1.2. SELinux

The SELinux project pages have troubleshooting tips, explanations, and pointers to documentation and references. Some useful links include the following:

8.1.3. SELinux enhancements

Different roles are now available, to allow finer-grained access control:
  • guest_t does not allow running setuid binaries, making network connections, or using a GUI.
  • xguest_t disallows network access except for HTTP via a Web browser, and no setuid binaries.
  • user_t is ideal for office users: prevents becoming root via setuid applications.
  • staff_t is same as user_t, except that root-level access via sudo is allowed.
  • unconfined_t provides full access, the same as when not using SELinux.
Browser plug-ins wrapped with nspluginwrapper, which is the default, are confined by SELinux policy.
SELinux and the Firefox mozplugger infrastructure may not work together as expected, due to fundamentally different goals for each. As a test or solution, to turn off SELinux confinement of nsplugin, run this command:
      setsebool -P allow_unconfined_nsplugin_transition =0

8.1.4. Security audit package

The new sectool provides users with a tool to check their systems for security issues. Included libraries allow for the customization of system tests. More information can be found at the project home:

8.1.5. General information

A general introduction to the many proactive security features in Fedora, current status, and policies is available at http://fedoraproject.org/wiki/Security.