SELinux workshop

2023-05-27, NUREMBERG
SELinux introduction
Johannes Segitz <jsegitz@suse.com>

Whoami
Johannes Segitz, security engineer at SUSE (Nuremberg, Germany)
– code review
– product pentesting
– The SELinux guy (not the policy maintainer)
Copyright © SUSE 2023 2

Outline
We will cover:
– Basic SELinux introduction
– Install it on openSUSE tumbleweed

Ressources needed
Please have an openSUSE Tumbleweed VM ready to play along
Make sure you have internet connectivity

Expectation management
As always it’s not possible to cover everything in one talk, so:
– Mix between
– higher level concepts (∼15 minutes)
– practice (∼45 minutes)
– You will not become a SELinux expert in an hour
– We will go as far as possible with the examples. I can stick around
afterwards, but we’ll stop officially after the slot ends

Nomenclature
How to read the slides
Shell:
$ this is a root shell
Default is root. If it’s a different user you’ll see it in the prompt.
Listing:
I'm the content of a file

Mandatory access control
Discretionary access control (DAC)
Usual form of access control in Linux
– Typical example:
root@workstation ~/ $ ls -l /etc/shadow
-rw-r-----. 1 root shadow 1421 /etc/shadow
– Discretionary: The owner of an object can control the access of the
objects he owns

Discretionary access control (DAC)
Drawbacks:
– Coarse: Basically 3 x rwx
– Prone to (user) error
johannes@workstation ~/ $ ls -lah ~/.ssh/id_rsa
-rw-rw-rw-. 1 jsegitz users 1.7K ~/.ssh/id_rsa
– Hard to analyze
– root == God (- capabilities)
But it’s familiar, easy to use and to understand

Mandatory access control (MAC)
Mandatory (in this context):
– Access control decisions are not made by the owner
– Access control rules are managed centrally
Advantages:
– Access control in the hand of people who know what they’re doing
– Centralized control and review is easy
– Often very fine grained → compartmentalization
Drawbacks:
– Harder to understand
– Complex to administrate
– Missing experience

SELinux
History
Security Enhanced Linux
– Linux security module (LSM), developed by the National Security
Agency (NSA)
Don’t panic, it’s open source and reviewed thoroughly
– First release 2000, since then integrated in the Linux kernel
Didn’t play a big role at SUSE up to this point
Will be the MAC system for ALP (and already is for SLE Micro)
So very likely it’s also the future MAC system for openSUSE

SELinux
Basic idea
– Type Enforcement (TE). Every object has a
– user: unconfined_u
– role: unconfined_r
– type: unconfined_t
– sensitivity: s0-s0
– category: c0.c1023
– These form the Security Context (SC)
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
– In practice the type unconfined_t is all you need

SELinux
SELinux expert with one character
If you remember one thing: let it be this

SELinux
Basic idea
(Almost) everything has a SC. Sockets, packets, ... 134 security classes
– Files
root@workstation ~/ $ ls -lZ /etc/shadow
----------. root root system_u:object_r:shadow_t:s0 /etc/shadow
– Processes
root@workstation ~/ $ ps axZ | grep 'postfix/master'
system_u:system_r:postfix_master_t:s0 1250 ? Ss 0:00 /usr/lib/

SELinux
Basic idea
– DAC comes first
– Then SELinux. Deny by default
– Firewall for system calls

SELinux
SELinux log messages
Found in the audit.log
type=AVC msg=audit(1416499522.810:77): avc: denied
{ transition } for pid=1282 comm="sshd" path="/usr/bin/zsh"
dev="vda2" ino=40462
scontext=system_u:system_r:kernel_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0
tclass=process

Practice
You’ll now change an openSUSE installation to use SELinux. Please boot
the machine

Practice
Initial setup
Install packages:
$ zypper in selinux-policy-targeted restorecond selinux-policy-devel policycoreutils setools-console
policycoreutils-devel selinux-autorelabel podman
Set SELinux to enforcing:
$ sed -i -e 's/SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
Main config file: /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
# minimum - Modification of targeted policy. Only selected processes are protected.
SELINUXTYPE=targeted

Practice
Initial setup
Set the necessary boot parameter:
$ if ! egrep 'GRUB_CMDLINE_LINUX_DEFAULT.*security=selinux selinux=1' /etc/default/grub >/dev/null; then
sed -i -E 's/(GRUB_CMDLINE_LINUX_DEFAULT=.*)"/1 security=selinux selinux=1"/' /etc/default/grub
fi
$ update-bootloader --refresh
Remove audit log, reboot:
$ rm /var/log/audit/audit.log
$ reboot

Practice
Look around
Current SELinux status
$ sestatus
Have a look at the processes
$ ps auxZ
Check out the filesystem labels
$ ls -laZ /
$ ls -laZ /var
Check for mislabeled files
$ restorecon -Rvn /var
$ restorecon -Rv /var

Practice
Look around
Check your identity
$ id -Z
Check denials:
$ grep -i avc /var/log/audit/audit.log
$ tail -f /var/log/audit/audit.log | grep -i avc
Proper way to do this:
$ ausearch -m avc,user_avc,selinux_err -ts boot -i

Practice
Linux users to SELinux users:
$ semanage login -l
Port mappings:
$ semanage port -l
File label rules:
$ semanage fcontext -l

Practice
Booleans:
$ semanage boolean -l
Enable a boolean:
$ semanage boolean -m --on httpd_enable_homedirs

Practice
audit2allow
audit2allow:
– Analyzes SELinux denial messages
– Generates rules to allow necessary access
– Is aware of interfaces
– Suggests booleans that would allow the access
But don’t use it with every denial!

Practice
audit2allow
Either pipe AVCs into audit2allow or feed into STDIN and close it:
$ audit2allow -R
Build SELinux module you can load:
$ audit2allow -R -M $NAMEMODULE

Practice
avcs.rb
Small wrapper around auserch. Makes reading AVCs easier
$ podman run --privileged -v /var/log/audit:/var/log/audit
registry.opensuse.org/home/jsegitz/containers/containers/avcs:latest

Practice
Lets cause problems
Mislabel some files:
$ ls -laZ /usr/sbin/postfix
$ chcon -t postfix_map_exec_t /usr/sbin/postfix
Check it:
$ restorecon -Rvn /usr/sbin/
Restart postfix:
$ systemctl restart postfix

Practice
Lets cause problems
Check the status:
$ systemctl status postfix
Why does it fail?
You’ll see something like
postfix[3427]: fatal: chdir(/var/spool/postfix): Permission denied
but no AVCs. How do we approach this?

Practice
How to debug SELinux problems
Does it happen in permissive mode?
$ setenforce 0
Check for denials. If you don’t see any disable dontaudit rules with
$ semodule -DB
Enable dontaudit again with
$ semodule -B
Now give audit2allow a try with this ...
Check for mislabled files
– either because of unaware scripts/programs
– policy paths don’t match

Practice
How to debug SELinux problems
Search engines/bugtrackers are your friends
Howto report a bug:
https://en.opensuse.org/openSUSE:Bugreport_SELinux

Practice
How to rescue a system
In grub change boot parameters:
– Disable SELinux: selinux=0
– Make SELinux permissive: enforcing=0

Questions?
Thank you for your attention!

SELinux workshop

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to SELinux workshop

Similar to SELinux workshop (20)

Recently uploaded

Recently uploaded (20)

SELinux workshop