Targeted vs. MLS SELinux Policies: Management Simplicity or High-Assurance Security

Policy Selection: Targeted vs. MLS

For the vast majority of production Fedora Server deployments, the increased security posture of the Multi-Level Security (MLS) policy does not justify the risk of application instability. Unless your environment is subject to a formal government or corporate mandate requiring strict data classification (e.g., Secret, Top Secret) and Bell-LaPadula confidentiality models, the Targeted policy is the recommended choice.

The Trade-off Analysis

The Targeted policy focuses on confining high-risk network daemons while leaving most user-space processes unconfined. This ensures high compatibility with third-party packages and minimal administrative overhead. In contrast, MLS adds sensitivity labels and categories to every object in the system. This creates a high probability of application failure because third-party software is rarely packaged with the specific MLS labels required for operation.

Verification Strategy for MLS Compatibility

If MLS is a requirement, you cannot rely on Targeted policy testing to predict MLS behavior. Use the following scoped strategy to verify compatibility before deployment:

1. Isolated Baseline: Provision a virtual machine matching your target Fedora release and install the exact set of third-party packages.
2. Permissive Testing: Switch the policy type to MLS and set the mode to permissive. Run your full application workload to identify missing labels without blocking execution.
3. AVC Analysis: Collect Access Vector Cache (AVC) denials from the audit logs. Use audit2why to determine if the denial is due to a missing type or a sensitivity label mismatch.
4. Label Mapping: Map the files, ports, and services of each third-party package to the required MLS categories and sensitivity levels.
5. Enforcing Validation: Switch to enforcing mode and verify that the application remains functional under the newly defined labels.

Practical Verification Commands

To check your current policy state and installed policy packages, use:

# Check current SELinux status and policy type
sestatus

# List installed SELinux policy packages
rpm -qa | grep selinux-policy

Assumptions and Constraints

This recommendation assumes a standard Fedora Server installation. Note that the availability of selinux-policy-mls may vary by Fedora release; if the package is not present in the official repositories for your version, MLS cannot be implemented without significant manual effort. To provide a more specific recommendation, please clarify if your deployment is subject to a specific compliance standard (e.g., Common Criteria or NIST).