SELinux for Everyday Users

Loading...

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

0 comments

Post a comment

    Post a comment
    Embed Video
    Edit your comment Cancel

    4 Favorites

    SELinux for Everyday Users - Presentation Transcript

    1. SELinux for everyday users
    2. SELinux Don't be afraid!
    3. SELinux – the bad
      • Developed by the NSA
    4. SELinux – the bad
      • Developed by the NSA
      • Mandatory Access Control
    5. SELinux – the bad
      • Developed by the NSA
      • Mandatory Access Control
      • Infested with jargon
        • Policies, contexts, labels, roles, objects, translation, types, ranges, booleans, oh my!
    6. SELinux – the bad
      • Developed by the NSA
      • Mandatory Access Control
      • Infested with jargon
      • Breaks systems
        • Root can't just do anything anymore
        • Applications stop working
        • Can't make it stop
    7. SELinux – the bad
      • “ SELinux is so horrible to use that, after wasting a large amount of time enabling it and then watching all of my applications die a horrible death since they didn't have the appropriate hand-crafted security policy, caused me to swear off of it. For me, given my threat model and how much my time is worth, life is too short for SELinux.”
        • Theodore Ts’o (ext2/3/4 maintainer)
    8. SELinux – the bad
      • “ SELinux is so horrible to use that, after wasting a large amount of time enabling it and then watching all of my applications die a horrible death since they didn't have the appropriate hand-crafted security policy, caused me to swear off of it. For me, given my threat model and how much my time is worth, life is too short for SELinux.”
        • Theodore Ts’o (ext2/3/4 maintainer)
        • Uses Debian
    9. SELinux – the bad
      • “ SELinux is so horrible to use that, after wasting a large amount of time enabling it and then watching all of my applications die a horrible death since they didn't have the appropriate hand-crafted security policy, caused me to swear off of it. For me, given my threat model and how much my time is worth, life is too short for SELinux.”
        • Theodore Ts’o (1 Oct 2007)
        • Uses Debian
        • Not an everyday user!
    10. SELinux Don't be afraid!
    11. SELinux – the good
      • “ Let me assure you that this action by the NSA was the crypto-equivalent of the Pope coming down off the balcony in Rome, working the crowd with a few loaves of bread and some fish, and then inviting everyone to come over to his place to watch the soccer game and have a few beers. There are some things that one just never expects to see, and the NSA handing out source code along with details of the security mechanism behind it was right up there on that list.”
        • Larry Loeb
    12. SELinux – the good
      • “ Let me assure you that this action by the NSA was the crypto-equivalent of the Pope coming down off the balcony in Rome, working the crowd with a few loaves of bread and some fish, and then inviting everyone to come over to his place to watch the soccer game and have a few beers. There are some things that one just never expects to see, and the NSA handing out source code along with details of the security mechanism behind it was right up there on that list.”
        • Larry Loeb (Security author and researcher)
    13. SELinux – the good
      • Used in many major distributions
    14. SELinux – the good
      • Used in many major distributions
        • In kernel since 2002
    15. SELinux – the good
      • Used in many major distributions
        • In kernel since 2002
        • Fedora since Core 2 (2004)
        • RHEL since version 4 (2005)
    16. SELinux – the good
      • Used in many major distributions
        • In kernel since 2002
        • Fedora since Core 2 (2004)
        • RHEL since version 4 (2005)
        • Debian since Etch (2007)
        • Ubuntu since Hardy Heron 8.04 (2008)
    17. SELinux How does it work?
    18. SELinux – the basics
      • Compiled into the kernel
    19. SELinux – the basics
      • Compiled into the kernel
      • Packaged security policy
    20. SELinux – the basics
      • Compiled into the kernel
      • Packaged security policy
      • Checks database of rules on syscalls
    21. SELinux – the basics
      • Compiled into the kernel
      • Packaged security policy
      • Checks database of rules on syscalls
      • Allows or denies based on policy
    22. SELinux What does it really do?
    23. SELinux – what does it do?
      • Stops daemons going bad
      tchmilfan : didi! - http://www.flickr.com/photos/tchmilfan/1033216436/
    24. SELinux – what does it do?
      • Stops daemons going bad
        • Policies in most distributions are applied only to system processes, not user processes.
    25. SELinux – what does it do?
      • Stops daemons going bad
        • Policies in most distributions are applied only to system processes, not user processes.
        • Policies limit what a daemon can access and how.
    26. SELinux – what does it do?
      • Stops daemons going bad
        • Policies in most distributions are applied only to system processes, not user processes.
        • Policies limit what a daemon can access and how.
        • Prevents daemon compromise affecting other files.
    27. SELinux – what does it do?
      • Stops daemons going bad
        • Policies in most distributions are applied only to system processes, not user processes.
        • Policies limit what a daemon can access and how.
        • Prevents daemon compromise affecting other files / users / ports / etc.
    28. SELinux – what does it do?
      • Stops daemons going bad
      • User processes are unaffected
    29. SELinux – what does it do?
      • Stops daemons going bad
      • User processes are unaffected
        • root still gets to be root
    30. SELinux – what does it do?
      • Stops daemons going bad
      • User processes are unaffected
        • root still gets to be root
        • Firefox still gets to crash your system
    31. SELinux – what does it do?
      • Stops daemons going bad
      • User processes are unaffected
        • root still gets to be root
        • Firefox still gets to crash your system
        • New policy being written to help that
    32. SELinux – demystifying
      • Everything has a security 'context'
    33. SELinux – demystifying
      • Everything has a security 'context'
        • A process has a context
    34. SELinux – demystifying
      • Everything has a security 'context'
        • A process has a context
        • A file has a context
    35. SELinux – demystifying
      • Everything has a security 'context'
        • A process has a context
        • A file has a context
      • Database of rules
    36. SELinux – demystifying
      • Everything has a security 'context'
        • A process has a context
        • A file has a context
      • Database of rules
        • Rules allow a process in one context to do operations on an object in another context
    37. SELinux – how do I see it?
      • Some commands have the -Z option
        • ls -Z
        • netstat -Z
        • ps -Z
    38. SELinux – how do I see it?
      • Some commands have the -Z option
        • ls -Z drwxr-xr-x paulway paulway user_u:object_r:user_home_t:s0 bin drwxrwxr-x paulway paulway user_u:object_r:user_home_t:s0 coding
        • netstat -Z tcp 0 0 tachyon:54421 upload.pmtpa.wikimedia:http ESTABLISHED 4243/firefox unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcp 1 0 tachyon.tangram.dnsal:46882 media:daap CLOSE_WAIT 1837/rhythmbox unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023
        • ps -Z LABEL PID TTY TIME CMD unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5950 pts/1 00:00:00 bash unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 6293 pts/1 00:00:00 ps
    39. SELinux – how do I see it?
      • Some commands have the -Z option
        • ls -Z drwxr-xr-x paulway paulway user_u:object_r: user_home_t :s0 bin drwxrwxr-x paulway paulway user_u:object_r: user_home_t :s0 coding
        • netstat -Z tcp 0 0 tachyon:54421 upload.pmtpa.wikimedia:http ESTABLISHED 4243/firefox unconfined_u:unconfined_r: unconfined_t :s0-s0:c0.c1023 tcp 1 0 tachyon.tangram.dnsal:46882 media:daap CLOSE_WAIT 1837/rhythmbox unconfined_r: unconfined_execmem_t :s0-s0:c0.c1023
        • ps -Z LABEL PID TTY TIME CMD unconfined_u:unconfined_r: unconfined_t :s0-s0:c0.c1023 5950 pts/1 00:00:00 bash unconfined_u:unconfined_r: unconfined_t :s0-s0:c0.c1023 6293 pts/1 00:00:00 ps
        • The type_t is the only thing you need look at
    40. SELinux – how do I use it?
      • restorecon
        • Restores the context of a file
        • Based on the rules for the directory structure
      • chcon
    41. SELinux – how do I use it?
      • restorecon
    42. SELinux – how do I use it?
      • restorecon
        • Restore s the default SELinux con text of a file
    43. SELinux – how do I use it?
      • restorecon
        • Restore s the default SELinux con text of a file
        • Looks up the database of rules and finds the correct context for that file
    44. SELinux – how do I use it? [root@tachyon ~]# ls -Z /etc/group -rw-r--r-- root root system_u:object_r:etc_t:s0 /etc/group
    45. SELinux – how do I use it? [root@tachyon ~]# ls -Z /etc/group -rw-r--r-- root root system_u:object_r:etc_t:s0 /etc/group [root@tachyon ~]# cp /etc/group /tmp [root@tachyon ~]# mv /tmp/group /etc [root@tachyon ~]# ls -Z /etc/group -rw-r--r-- root root system_u:object_r:user_tmp_t:s0 /etc/group
    46. SELinux – how do I use it? [root@tachyon ~]# ls -Z /etc/group -rw-r--r-- root root system_u:object_r:etc_t:s0 /etc/group [root@tachyon ~]# cp /etc/group /tmp [root@tachyon ~]# mv /tmp/group /etc [root@tachyon ~]# ls -Z /etc/group -rw-r--r-- root root system_u:object_r:user_tmp_t:s0 /etc/group [root@tachyon ~]# restorecon -R -v /etc/group restorecon reset /etc/group context system_u:object_r:user_tmp_t:s0->system_u:object_r:etc_t:s0 [root@tachyon ~]# ls -Z /etc/group -rw-r--r-- root root system_u:object_r:etc_t:s0 /etc/group
    47. SELinux – Lessons
      • 1: Try restorecon
    48. SELinux – demystifying
      • Everything has a context
      • Database of rules
        • Rules allow a process in one context to do operations on an object in another context
    49. SELinux – demystifying
      • Everything has a context
      • Database of rules
        • Rules allow a process in one context to do operations on an object in another context
      • Switches turn groups of rules on or off
    50. SELinux – demystifying
      • Everything has a context
      • Database of rules
        • Rules allow a process in one context to do operations on an object in another context
      • Switches turn groups of rules on or off
        • Booleans
    51. SELinux – how do I see it?
      • getsebool -a
    52. SELinux – how do I see it?
      • getsebool -a
      [root@tachyon ~]# getsebool -a | grep samba samba_domain_controller --> off samba_enable_home_dirs --> off samba_export_all_ro --> off samba_export_all_rw --> off samba_run_unconfined --> on samba_share_fusefs --> off samba_share_nfs --> off use_samba_home_dirs --> off virt_use_samba --> off
    53. SELinux – how do I use it?
      • setsebool
      [root@tachyon ~]# getsebool -a | grep samba samba_domain_controller --> off samba_enable_home_dirs --> off samba_export_all_ro --> off samba_export_all_rw --> off samba_run_unconfined --> on samba_share_fusefs --> off samba_share_nfs --> off use_samba_home_dirs --> off virt_use_samba --> off [root@tachyon ~]# setsebool samba_enable_home_dirs on [root@tachyon ~]# getsebool -a | grep samba_enable_home_dirs samba_enable_home_dirs --> on
    54. SELinux – how do I use it?
      • setsebool – ONLY THIS SESSION!
      [root@tachyon ~]# getsebool -a | grep samba samba_domain_controller --> off samba_enable_home_dirs --> off samba_export_all_ro --> off samba_export_all_rw --> off samba_run_unconfined --> on samba_share_fusefs --> off samba_share_nfs --> off use_samba_home_dirs --> off virt_use_samba --> off [root@tachyon ~]# setsebool samba_enable_home_dirs on [root@tachyon ~]# getsebool -a | grep samba_enable_home_dirs samba_enable_home_dirs --> on
    55. SELinux – how do I use it?
      • setsebool -P
      [root@tachyon ~]# getsebool -a | grep samba samba_domain_controller --> off samba_enable_home_dirs --> off samba_export_all_ro --> off samba_export_all_rw --> off samba_run_unconfined --> on samba_share_fusefs --> off samba_share_nfs --> off use_samba_home_dirs --> off virt_use_samba --> off [root@tachyon ~]# setsebool -P samba_enable_home_dirs on [root@tachyon ~]# getsebool -a | grep samba_enable_home_dirs samba_enable_home_dirs --> on
    56. SELinux – Lessons
      • 1: Try restorecon
      • 2: getsebool and setsebool
    57. SELinux – how do I see it?
      • Some commands have the -Z option
        • ls -Z
        • netstat -Z
        • ps -Z
      • Audit messages go to /var/log/audit/audit.log
    58. SELinux – how do I see it?
      • Some commands have the -Z option
        • ls -Z
        • netstat -Z
        • ps -Z
      • Audit messages go to /var/log/audit/audit.log
        • Some messages may be in /var/log/messages
    59. SELinux – how do I see it? [root@tachyon ~]# tail -4 /var/log/audit/audit.log
    60. SELinux – how do I see it? [root@tachyon ~]# tail -4 /var/log/audit/audit.log type=AVC msg=audit(1219408121.814:62): avc: denied { read } for pid=2184 comm="hald" name="group" dev=dm-0 ino=460208 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1219408121.814:62): arch=40000003 syscall=5 success=no exit=-13 a0=119f2d a1=80000 a2=1b6 a3=80000 items=0 ppid=1 pid=2184 auid=4294967295 uid=68 gid=68 euid=68 suid=68 fsuid=68 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="hald" exe="/usr/sbin/hald" subj=system_u:system_r:hald_t:s0 key=(null) type=AVC msg=audit(1219408127.814:63): avc: denied { read } for pid=2184 comm="hald" name="group" dev=dm-0 ino=460208 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1219408127.814:63): arch=40000003 syscall=5 success=no exit=-13 a0=119f2d a1=80000 a2=1b6 a3=80000 items=0 ppid=1 pid=2184 auid=4294967295 uid=68 gid=68 euid=68 suid=68 fsuid=68 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="hald" exe="/usr/sbin/hald" subj=system_u:system_r:hald_t:s0 key=(null)
    61. SELinux – how do I use it? [root@tachyon ~]# grep hald /var/log/audit/audit.log | audit2why type=AVC msg=audit(1219408127.814:63): avc: denied { read } for pid=2184 comm="hald" name="group" dev=dm-0 ino=460208 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:user_tmp_t:s0 tclass=file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.
    62. SELinux – Lessons
      • 1: Try restorecon
      • 2: getsebool and setsebool
      • 3: audit2why or audit2allow
    63. SELinux – Lessons
      • 1: Try restorecon
      • 2: getsebool and setsebool
      • 3: audit2why or audit2allow
        • unless you're working on a system daemon problem.
    64. SELinux – Lessons
      • 1: Try restorecon
      • 2: getsebool and setsebool
      • 3: audit2why or audit2allow
        • Much more, but it's not for every day.
    65. Questions?
    66. Questions?
      • Best effort only ☺

    + PaulWayPaulWay, 4 months ago

    custom

    3626 views, 4 favs, 4 embeds more stats

    Much has been written on SELinux, and a lot of it s more

    More info about this document

    © All Rights Reserved

    Go to text version

    • Total Views 3626
      • 2945 on SlideShare
      • 681 from embeds
    • Comments 0
    • Favorites 4
    • Downloads 69
    Most viewed embeds
    • 641 views on http://www.ossblog.it
    • 38 views on http://blog.dgrossato.com
    • 1 views on http://brescia.bakeca.it
    • 1 views on http://www.ereiser.org

    more

    All embeds
    • 641 views on http://www.ossblog.it
    • 38 views on http://blog.dgrossato.com
    • 1 views on http://brescia.bakeca.it
    • 1 views on http://www.ereiser.org

    less

    Flagged as inappropriate Flag as inappropriate
    Flag as inappropriate

    Select your reason for flagging this presentation as inappropriate. If needed, use the feedback form to let us know more details.

    Cancel
    File a copyright complaint
    Having problems? Go to our helpdesk?

    Categories