Ctrl.blog

Disabling of SELinux

Both Linode and Vultr used to disable SELinux by default, which meant customers didn’t get the same experience when deploying servers through these server providers when compared to a default installation of Fedora Server edition.

Linode replaced the kernel provided by the Fedora project with their own Linode Unified Kernel (LUK). My review of Linode VPS contains a long section detailing LUK. LUK was being compiled with SELinux disabled, but Linode hadn’t disabled SELinux – causing some funny boot time messages about SELinux being turned on but not being available in the Kernel. The result was that the SELinux policy set wasn’t being enforced. Re-enabling the default Fedora kernel — to enable SELinux with it — required changes to the server’s configuration in the Linode Manager, plus enough knowledge to relabel and repair a system with broken SELinux labels.

Vultr had just disabled the SELinux option while keeping the default kernel. Resetting to default enabled state required restoring the configuration for SELinux and a full relabeling of the system.

Aligning with upstream defaults

If you deploy a new instance of Fedora Server 27 on Linode today, you’ll now get an unmodified system image that’s enforcing SELinux policies by default.

Vultr have been enforcing SELinux by default in all supported versions of Fedora since late August 2017.

Note that updating an existing Fedora Server instance with either Linode or Vultr won’t suddenly enable SELinux. The change only applies to new instances deployed for the specific versions or since the dates mentioned above.

These changes means Fedora users who deploy with any of these cloud service providers now get a system that’s much closer to the default Fedora Server experience. Documentation and community support now match the default experiences with Fedora.

Why the change happened

I wasn’t happy after having made the switch from DigitalOcean, another VPS hosting provider, to Linode and found that my distribution of choice, Fedora 22 at the time, differed greatly from Fedora on DigitalOcean and on my own hardware. I vented some frustration in my Linode review, made the [complex] required changes to use the default Fedora kernel, and let it be with that.

Some months later I was managing more instances on Linode, and had started playing with Vultr as a possible Linode replacement. Vultr reportedly has slightly better performance than Linode for the same cost, so I thought I’d have a look at it. Again, I was frustrated when I found out that Vultr also had disabled SELinux by default!

I remember having read about Canonical taking action against modified versions of Ubuntu offered with some service providers. Ubuntu includes a clause that you’ve to change the name if you modify and redistribute copies of Ubuntu to others, on grounds of protecting the Ubuntu trademark. After some research, I found that Fedora had similar legal requirements for use of their trademark to those of Ubuntu.

The gist of these trademark use requirements means that Linode and Vultr would have to rename their modified versions of Fedora to something like “Linode Fedora Remix” in marketing to clearly differentiate it from the upstream Fedora as distributed by the Fedora project. I would have been perfectly happy with this resolution as I’d know that I wasn’t getting the stock default Fedora Server edition with this naming scheme.

I proceeded to open a ticket with the Fedora Council requesting that the council look into the matter of modified VPS images as distributed by these two cloud providers. The matter was referred to Tom ‘spot’ Callaway of the Fedora legal team who worked with Lindoe and Vultr. Vultr was able to resolve the matter in four months, while it took Linode seven months to resolve the issue.