SlideShare a Scribd company logo
SELinux
MAC and the story of
“Why doesn’t that work?”
Some History
• Discretionary access control (DAC) is the
traditional form of access control
• Uses the familiar r-w-x settings for users and
groups
• Controls access to all file resources including
device files (i.e. ports)
Enter MAC
• Mandatory Access Control (MAC) is a kind of
supervisor of security
• Each object (think ‘file’) is labeled with a
classification
• Each subject (think ‘user’) is labeled with an
access level
• Any read or write is evaluated by the supervisor
Enter MAC (cont.)
• SELinux is a method for for MAC on Linux
• Policies are created which define which subjects
may perform which actions on which objects
DAC vs. MAC
• In DAC, a user’s access to a file is controlled by
what discrete permissions are set on the file.
• In MAC, a user’s access to a file is controlled by
evaluating the user’s label and the file’s label
and looking at the rules which define the access
• In practice, DAC and MAC are used together.
• If a file is r—r—r--, the user can’t write to it even
if a policy in SELinux grants access
How does this work in practice?
• Consider the process httpd
• ls –Z on /usr/sbin/httpd returns
system_u:object_r:httpd_exec_t:s0
• Four fields
– User
– Role
– Type
– Level
User:Role:Type:Level
• User field groups types of users or roles
• Likely values in this field are user_u, system_u,
or root
User:Role:Type:Level
• Role field on a file is always object_r
• Relevant when labeling processes
• Possible to design policies to specify which roles
have access to which types – this would be
Roles Based Access Control (RBAC)
• Examples roles are sysadm_r, staff_r, secadm_r
User:Role:Type:Level
• Type field is which most policy rules are based
around
• Think “what subjects have access to which
types”
User:Role:Type:Level
• MultiLevelSecurity (MLS) field
• Normally displaying s0,s1,s2, etc
• Might be configured to display PatientRecord,
CompanyConfidential,Public
What to remember
• SELinux has three forms of access control
– Type Enforcement(TE)
– Role-Based Access Control (RBAC)
– Multi-Level Security (MLS)
• By default access is Denied
In use…
• $ps –Z to see info for processes
• $ls –Z to see info for files
• $chcon to change ( chcon –v –type=user_t
filename)
References
• https://fedoraproject.org/wiki/Security_context
• http://www.crypt.gen.nz/papers/selinux_introduct
ion.html
• http://publib.boulder.ibm.com/infocenter/lnxinfo/v
3r0m0/topic/liaai/selinux/liaaiselinuxsecurity.htm
• http://people.redhat.com/dwalsh/SELinux/Presen
tations/ManageRHEL5.pdf
This work is licensed under the Creative Commons
Attribution-ShareAlike 3.0 United States License.
To view a copy of this license, visit
http://creativecommons.org/licenses/by-sa/3.0/us/

More Related Content

Similar to SE Linux

Os8
Os8Os8
How to Audit Linux - Gene Kartavtsev, ISACA MN
How to Audit Linux - Gene Kartavtsev, ISACA MNHow to Audit Linux - Gene Kartavtsev, ISACA MN
How to Audit Linux - Gene Kartavtsev, ISACA MN
Gene Kartavtsev
 
Lucene solrrev documentlevelsecurity_rajanimaski_final
Lucene solrrev documentlevelsecurity_rajanimaski_finalLucene solrrev documentlevelsecurity_rajanimaski_final
Lucene solrrev documentlevelsecurity_rajanimaski_final
Rajani Maski
 
Protection and security of operating system
Protection and security of operating systemProtection and security of operating system
Protection and security of operating system
Abdullah Khosa
 
Top school in noida
Top school in noidaTop school in noida
Top school in noida
Edhole.com
 
Introduction to System Calls
Introduction to System CallsIntroduction to System Calls
Introduction to System Calls
Vandana Salve
 
A Novel methodology for handling Document Level Security in Search Based Appl...
A Novel methodology for handling Document Level Security in Search Based Appl...A Novel methodology for handling Document Level Security in Search Based Appl...
A Novel methodology for handling Document Level Security in Search Based Appl...
lucenerevolution
 
Ch13 protection
Ch13   protectionCh13   protection
Ch13 protection
Welly Dian Astika
 
Performance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTracePerformance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTrace
Graeme Jenkinson
 
Topic 7 access control
Topic 7 access controlTopic 7 access control
Oerating system project
Oerating system projectOerating system project
Oerating system project
Hira Gul
 
Services and system calls
Services and system callsServices and system calls
Services and system calls
sangrampatil81
 
Licão 04 permissions
Licão 04 permissionsLicão 04 permissions
Licão 04 permissions
Acácio Oliveira
 
Se linux course1
Se linux course1Se linux course1
Protection Domain and Access Matrix Model -Operating System
Protection Domain and Access Matrix Model -Operating SystemProtection Domain and Access Matrix Model -Operating System
Protection Domain and Access Matrix Model -Operating System
LalfakawmaKh
 
Ppt linux
Ppt linuxPpt linux
Ppt linux
Gurpreet Kaur
 
Least privilege, access control, operating system security
Least privilege, access control, operating system securityLeast privilege, access control, operating system security
Least privilege, access control, operating system security
G Prachi
 
operating system calls input and output by (rohit malav)
operating system calls input and output by (rohit malav)operating system calls input and output by (rohit malav)
operating system calls input and output by (rohit malav)
Rohit malav
 
Unix system protection and history features
Unix system protection and history featuresUnix system protection and history features
Unix system protection and history features
roopav27
 
04-1-Linux.ppt
04-1-Linux.ppt04-1-Linux.ppt
04-1-Linux.ppt
EidTahir
 

Similar to SE Linux (20)

Os8
Os8Os8
Os8
 
How to Audit Linux - Gene Kartavtsev, ISACA MN
How to Audit Linux - Gene Kartavtsev, ISACA MNHow to Audit Linux - Gene Kartavtsev, ISACA MN
How to Audit Linux - Gene Kartavtsev, ISACA MN
 
Lucene solrrev documentlevelsecurity_rajanimaski_final
Lucene solrrev documentlevelsecurity_rajanimaski_finalLucene solrrev documentlevelsecurity_rajanimaski_final
Lucene solrrev documentlevelsecurity_rajanimaski_final
 
Protection and security of operating system
Protection and security of operating systemProtection and security of operating system
Protection and security of operating system
 
Top school in noida
Top school in noidaTop school in noida
Top school in noida
 
Introduction to System Calls
Introduction to System CallsIntroduction to System Calls
Introduction to System Calls
 
A Novel methodology for handling Document Level Security in Search Based Appl...
A Novel methodology for handling Document Level Security in Search Based Appl...A Novel methodology for handling Document Level Security in Search Based Appl...
A Novel methodology for handling Document Level Security in Search Based Appl...
 
Ch13 protection
Ch13   protectionCh13   protection
Ch13 protection
 
Performance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTracePerformance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTrace
 
Topic 7 access control
Topic 7 access controlTopic 7 access control
Topic 7 access control
 
Oerating system project
Oerating system projectOerating system project
Oerating system project
 
Services and system calls
Services and system callsServices and system calls
Services and system calls
 
Licão 04 permissions
Licão 04 permissionsLicão 04 permissions
Licão 04 permissions
 
Se linux course1
Se linux course1Se linux course1
Se linux course1
 
Protection Domain and Access Matrix Model -Operating System
Protection Domain and Access Matrix Model -Operating SystemProtection Domain and Access Matrix Model -Operating System
Protection Domain and Access Matrix Model -Operating System
 
Ppt linux
Ppt linuxPpt linux
Ppt linux
 
Least privilege, access control, operating system security
Least privilege, access control, operating system securityLeast privilege, access control, operating system security
Least privilege, access control, operating system security
 
operating system calls input and output by (rohit malav)
operating system calls input and output by (rohit malav)operating system calls input and output by (rohit malav)
operating system calls input and output by (rohit malav)
 
Unix system protection and history features
Unix system protection and history featuresUnix system protection and history features
Unix system protection and history features
 
04-1-Linux.ppt
04-1-Linux.ppt04-1-Linux.ppt
04-1-Linux.ppt
 

More from primeteacher32

Software Development Life Cycle
Software Development Life CycleSoftware Development Life Cycle
Software Development Life Cycle
primeteacher32
 
Variable Scope
Variable ScopeVariable Scope
Variable Scope
primeteacher32
 
Returning Data
Returning DataReturning Data
Returning Data
primeteacher32
 
Intro to Functions
Intro to FunctionsIntro to Functions
Intro to Functions
primeteacher32
 
Introduction to GUIs with guizero
Introduction to GUIs with guizeroIntroduction to GUIs with guizero
Introduction to GUIs with guizero
primeteacher32
 
Function Parameters
Function ParametersFunction Parameters
Function Parameters
primeteacher32
 
Nested Loops
Nested LoopsNested Loops
Nested Loops
primeteacher32
 
Conditional Loops
Conditional LoopsConditional Loops
Conditional Loops
primeteacher32
 
Introduction to Repetition Structures
Introduction to Repetition StructuresIntroduction to Repetition Structures
Introduction to Repetition Structures
primeteacher32
 
Input Validation
Input ValidationInput Validation
Input Validation
primeteacher32
 
Windows File Systems
Windows File SystemsWindows File Systems
Windows File Systems
primeteacher32
 
Nesting Conditionals
Nesting ConditionalsNesting Conditionals
Nesting Conditionals
primeteacher32
 
Conditionals
ConditionalsConditionals
Conditionals
primeteacher32
 
Intro to Python with GPIO
Intro to Python with GPIOIntro to Python with GPIO
Intro to Python with GPIO
primeteacher32
 
Variables and Statements
Variables and StatementsVariables and Statements
Variables and Statements
primeteacher32
 
Variables and User Input
Variables and User InputVariables and User Input
Variables and User Input
primeteacher32
 
Intro to Python
Intro to PythonIntro to Python
Intro to Python
primeteacher32
 
Raspberry Pi
Raspberry PiRaspberry Pi
Raspberry Pi
primeteacher32
 
Hardware vs. Software Presentations
Hardware vs. Software PresentationsHardware vs. Software Presentations
Hardware vs. Software Presentations
primeteacher32
 
Block chain security
Block chain securityBlock chain security
Block chain security
primeteacher32
 

More from primeteacher32 (20)

Software Development Life Cycle
Software Development Life CycleSoftware Development Life Cycle
Software Development Life Cycle
 
Variable Scope
Variable ScopeVariable Scope
Variable Scope
 
Returning Data
Returning DataReturning Data
Returning Data
 
Intro to Functions
Intro to FunctionsIntro to Functions
Intro to Functions
 
Introduction to GUIs with guizero
Introduction to GUIs with guizeroIntroduction to GUIs with guizero
Introduction to GUIs with guizero
 
Function Parameters
Function ParametersFunction Parameters
Function Parameters
 
Nested Loops
Nested LoopsNested Loops
Nested Loops
 
Conditional Loops
Conditional LoopsConditional Loops
Conditional Loops
 
Introduction to Repetition Structures
Introduction to Repetition StructuresIntroduction to Repetition Structures
Introduction to Repetition Structures
 
Input Validation
Input ValidationInput Validation
Input Validation
 
Windows File Systems
Windows File SystemsWindows File Systems
Windows File Systems
 
Nesting Conditionals
Nesting ConditionalsNesting Conditionals
Nesting Conditionals
 
Conditionals
ConditionalsConditionals
Conditionals
 
Intro to Python with GPIO
Intro to Python with GPIOIntro to Python with GPIO
Intro to Python with GPIO
 
Variables and Statements
Variables and StatementsVariables and Statements
Variables and Statements
 
Variables and User Input
Variables and User InputVariables and User Input
Variables and User Input
 
Intro to Python
Intro to PythonIntro to Python
Intro to Python
 
Raspberry Pi
Raspberry PiRaspberry Pi
Raspberry Pi
 
Hardware vs. Software Presentations
Hardware vs. Software PresentationsHardware vs. Software Presentations
Hardware vs. Software Presentations
 
Block chain security
Block chain securityBlock chain security
Block chain security
 

Recently uploaded

一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理
一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理
一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理
zqgk8x
 
一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理
一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理
一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理
zukou
 
一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理
一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理
一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理
nguqayx
 
22. Certificate of Appreciation Deepika.
22. Certificate of Appreciation Deepika.22. Certificate of Appreciation Deepika.
22. Certificate of Appreciation Deepika.
Manu Mitra
 
0624.CV_studentscholarandacademic-02.pdf
0624.CV_studentscholarandacademic-02.pdf0624.CV_studentscholarandacademic-02.pdf
0624.CV_studentscholarandacademic-02.pdf
Thomas GIRARD BDes
 
0624.CV_studentscholarandacademic-01.pdf
0624.CV_studentscholarandacademic-01.pdf0624.CV_studentscholarandacademic-01.pdf
0624.CV_studentscholarandacademic-01.pdf
Thomas GIRARD BDes
 
按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理
按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理
按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理
evnum
 
LinkedIn for Your Job Search June 17, 2024
LinkedIn for Your Job Search June  17, 2024LinkedIn for Your Job Search June  17, 2024
LinkedIn for Your Job Search June 17, 2024
Bruce Bennett
 
体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】
体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】
体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】
waldorfnorma258
 
美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】
美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】
美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】
ahmedendrise81
 
欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】
欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】
欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】
landrielgabriel274
 
美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】
美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】
美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】
hanniaarias53
 
欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】
欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】
欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】
karimimorine448
 
一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理
一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理
一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理
aweuwyo
 
Learnings from Successful Jobs Searchers
Learnings from Successful Jobs SearchersLearnings from Successful Jobs Searchers
Learnings from Successful Jobs Searchers
Bruce Bennett
 
欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】
欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】
欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】
lemike859
 
欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】
欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】
欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】
mukeshomran942
 
Community Skills Building Workshop | PMI Silver Spring Chapter | June 12, 2024
Community Skills Building Workshop | PMI Silver Spring Chapter  | June 12, 2024Community Skills Building Workshop | PMI Silver Spring Chapter  | June 12, 2024
Community Skills Building Workshop | PMI Silver Spring Chapter | June 12, 2024
Hector Del Castillo, CPM, CPMM
 
Untitled presentation.pptx jklyvtguhiohk
Untitled presentation.pptx jklyvtguhiohkUntitled presentation.pptx jklyvtguhiohk
Untitled presentation.pptx jklyvtguhiohk
Excellence Tecnology
 
办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样
办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样
办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样
kkkkr4pg
 

Recently uploaded (20)

一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理
一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理
一比一原版英国伦敦南岸大学毕业证(LSBU学位证)如何办理
 
一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理
一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理
一比一原版(kcl毕业证书)英国金斯顿大学毕业证如何办理
 
一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理
一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理
一比一原版(EUR毕业证)鹿特丹伊拉斯姆斯大学毕业证如何办理
 
22. Certificate of Appreciation Deepika.
22. Certificate of Appreciation Deepika.22. Certificate of Appreciation Deepika.
22. Certificate of Appreciation Deepika.
 
0624.CV_studentscholarandacademic-02.pdf
0624.CV_studentscholarandacademic-02.pdf0624.CV_studentscholarandacademic-02.pdf
0624.CV_studentscholarandacademic-02.pdf
 
0624.CV_studentscholarandacademic-01.pdf
0624.CV_studentscholarandacademic-01.pdf0624.CV_studentscholarandacademic-01.pdf
0624.CV_studentscholarandacademic-01.pdf
 
按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理
按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理
按照学校原版(UofT文凭证书)多伦多大学毕业证快速办理
 
LinkedIn for Your Job Search June 17, 2024
LinkedIn for Your Job Search June  17, 2024LinkedIn for Your Job Search June  17, 2024
LinkedIn for Your Job Search June 17, 2024
 
体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】
体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】
体育博彩论坛-十大体育博彩论坛-体育博彩论坛|【​网址​🎉ac55.net🎉​】
 
美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】
美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】
美洲杯买球-美洲杯买球下注平台-美洲杯买球投注平台|【​网址​🎉ac55.net🎉​】
 
欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】
欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】
欧洲杯外围-欧洲杯外围下注网址-欧洲杯外围下注网站|【​网址​🎉ac44.net🎉​】
 
美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】
美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】
美洲杯体育投注-美洲杯体育投注推荐-美洲杯体育投注|【​网址​🎉ac10.net🎉​】
 
欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】
欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】
欧洲杯外围-欧洲杯外围赛程-欧洲杯外围压注|【​网址​🎉ac99.net🎉​】
 
一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理
一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理
一比一原版(uwm毕业证书)美国威斯康星大学密尔沃基分校毕业证如何办理
 
Learnings from Successful Jobs Searchers
Learnings from Successful Jobs SearchersLearnings from Successful Jobs Searchers
Learnings from Successful Jobs Searchers
 
欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】
欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】
欧洲杯足彩-欧洲杯足彩体育投注-欧洲杯足彩投注网站|【​网址​🎉ac99.net🎉​】
 
欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】
欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】
欧洲杯投注-欧洲杯投注投注官方网站-欧洲杯投注买球投注官网|【​网址​🎉ac99.net🎉​】
 
Community Skills Building Workshop | PMI Silver Spring Chapter | June 12, 2024
Community Skills Building Workshop | PMI Silver Spring Chapter  | June 12, 2024Community Skills Building Workshop | PMI Silver Spring Chapter  | June 12, 2024
Community Skills Building Workshop | PMI Silver Spring Chapter | June 12, 2024
 
Untitled presentation.pptx jklyvtguhiohk
Untitled presentation.pptx jklyvtguhiohkUntitled presentation.pptx jklyvtguhiohk
Untitled presentation.pptx jklyvtguhiohk
 
办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样
办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样
办理阿卡迪亚大学毕业证(uvic毕业证)本科文凭证书原版一模一样
 

SE Linux

  • 1. SELinux MAC and the story of “Why doesn’t that work?”
  • 2. Some History • Discretionary access control (DAC) is the traditional form of access control • Uses the familiar r-w-x settings for users and groups • Controls access to all file resources including device files (i.e. ports)
  • 3. Enter MAC • Mandatory Access Control (MAC) is a kind of supervisor of security • Each object (think ‘file’) is labeled with a classification • Each subject (think ‘user’) is labeled with an access level • Any read or write is evaluated by the supervisor
  • 4. Enter MAC (cont.) • SELinux is a method for for MAC on Linux • Policies are created which define which subjects may perform which actions on which objects
  • 5. DAC vs. MAC • In DAC, a user’s access to a file is controlled by what discrete permissions are set on the file. • In MAC, a user’s access to a file is controlled by evaluating the user’s label and the file’s label and looking at the rules which define the access • In practice, DAC and MAC are used together. • If a file is r—r—r--, the user can’t write to it even if a policy in SELinux grants access
  • 6. How does this work in practice? • Consider the process httpd • ls –Z on /usr/sbin/httpd returns system_u:object_r:httpd_exec_t:s0 • Four fields – User – Role – Type – Level
  • 7. User:Role:Type:Level • User field groups types of users or roles • Likely values in this field are user_u, system_u, or root
  • 8. User:Role:Type:Level • Role field on a file is always object_r • Relevant when labeling processes • Possible to design policies to specify which roles have access to which types – this would be Roles Based Access Control (RBAC) • Examples roles are sysadm_r, staff_r, secadm_r
  • 9. User:Role:Type:Level • Type field is which most policy rules are based around • Think “what subjects have access to which types”
  • 10. User:Role:Type:Level • MultiLevelSecurity (MLS) field • Normally displaying s0,s1,s2, etc • Might be configured to display PatientRecord, CompanyConfidential,Public
  • 11. What to remember • SELinux has three forms of access control – Type Enforcement(TE) – Role-Based Access Control (RBAC) – Multi-Level Security (MLS) • By default access is Denied
  • 12. In use… • $ps –Z to see info for processes • $ls –Z to see info for files • $chcon to change ( chcon –v –type=user_t filename)
  • 13. References • https://fedoraproject.org/wiki/Security_context • http://www.crypt.gen.nz/papers/selinux_introduct ion.html • http://publib.boulder.ibm.com/infocenter/lnxinfo/v 3r0m0/topic/liaai/selinux/liaaiselinuxsecurity.htm • http://people.redhat.com/dwalsh/SELinux/Presen tations/ManageRHEL5.pdf
  • 14. This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/us/