How to live with SELinux
•Download as ODP, PDF•
11 likes•2,336 views
This document provides an overview of how to configure and manage SELinux on Linux systems. It discusses SELinux concepts like contexts, booleans, and policies. It also provides instructions for managing ports, file contexts, and copying or moving files while preserving security contexts. The document is intended to help users understand and live with SELinux on their systems.
![You can find me here ,[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to How to live with SELinux
Similar to How to live with SELinux (20)
More from Bert Desmet
Recently uploaded
Recently uploaded (20)
How to live with SELinux
- 1. How to live with SELinux Bert Desmet – Fedora Ambassador
- 7. Irc: biertie @ Freenode / Quakenet
- 9. Google me for more And if you have any questions, feel free to contact me..
- 12. Designer of the T shirt
- 14. How to live with SELinux
- 18. Backing up and copying
- 21. Build by NSA
- 23. RBAC: user privilege controls
- 26. Reduces vulnerability to attacks
- 29. No firewall
- 30. ....
- 40. setsebool -P $boolean {on|off}
- 44. object_r: role aspect for the context
- 46. S0: level of security
- 48. semange fcontext -dv ${file|dir}name
- 51. fixfiles -R $packagename restore
- 58. It does when you move on the same partition
- 59. Use cp command
- 64. audit2allow -am $name > $name.te
- 65. -D flag
- 69. It's secure
- 71. Questions? E-mail: [email_address] Twitter: @biertie identi.ca: @bdesmet Web: http://bdesmet.be
Editor's Notes
- MLS: Multi-Level Security RBAC: Role-based access control TE: Type Enforcement MAC: mandatory acces control <-> DAC: Discretionary acces control Adds extra control over processes and users (what files can x or y change)
- Good access control, unlike DAC from normal linux system. SELinux user, role, type, level while linux user only have a group and user id Reduces vulnerability to attacks due to access control. Intruders can only access the files the software (like httpd) really need Confined servers: selinux has the abitilty to confine services and deamons so that they are more predictable and are only allowed acces that is required for their normal operation
- Independent from normal linux ownerships blah blah
- Var/log/messages are better readable, but rsyslogd is not always running. Chkconfig –levels 2345 rsyslogd on
- Booleans Changed at runtime No policy writing
- Predefined policies The semanage boolean command doesn't work yet on RH/Centos 5.x -P flag makes it persistent over reboots
- Identity authorized for specific set of roles, and mls range. Semange login -l Each linux user is mapped to a sel user Role is part of the RBAC model. Type is an attribute of type enforcement. Defines domain for processes, and type for files. Level of security is attribute for MLS. For process, unconfined_t : is not checked (in targeted)
- Chcon -t httpd_sys_content_t /web Use full path of file/dir Restore only works with chcon semange fcontext adds rule to file.contexts.local, chcon doesn't After a fcontext -d run restorecon again.
- Fixfiles relabel can make system unstable Fixfiles -R relies on rpm database
- Standard type: nfs_t Context changes to the files on the mount won't work. Chcon results in “operation not supported” /dev/sda2: assumes there are no rules that define context for /foo/ Files will keep context when changed Persistent: fstab
- If you copy a file over a file, original context is preserved
- matchpathcon - get the default security context for the specified path from the file contexts configuration. Semodule -D : disables dontaudit rules -B : rebuilds policy Run semodule -B again after debugging
- cat $name.te
- Semodule: import the module