SELinux System Administration - Second Edition

SELinux System Administration - Second Edition

by Sven Vermeulen
Released December 2016
Publisher(s): Packt Publishing
ISBN: 9781787126954

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Ward off traditional security permissions and effectively secure your Linux systems with SELinux

Key Features

  • Leverage SELinux to improve the secure state of your Linux system
  • A clear approach to adopting SELinux within your organization
  • Essential skills and techniques to help further your system administration career

Book Description

Do you have the crucial job of protecting your private and company systems from malicious attacks and undefined application behavior? Are you looking to secure your Linux systems with improved access controls? Look no further, intrepid administrator! This book will show you how to enhance your system's secure state across Linux distributions, helping you keep application vulnerabilities at bay.

This book covers the core SELinux concepts and shows you how to leverage SELinux to improve the protection measures of a Linux system. You will learn the SELinux fundamentals and all of SELinux's configuration handles including conditional policies, constraints, policy types, and audit capabilities. These topics are paired with genuine examples of situations and issues you may come across as an administrator. In addition, you will learn how to further harden the virtualization offering of both libvirt (sVirt) and Docker through SELinux.

By the end of the book you will know how SELinux works and how you can tune it to meet your needs

What you will learn

  • Analyze SELinux events and selectively enable or disable SELinux enforcement
  • Manage Linux users and associate them with the right role and permission set
  • Secure network communications through SELinux access controls
  • Tune the full service flexibility by dynamically assigning resource labels
  • Handle SELinux access patterns enforced through the system
  • Query the SELinux policy in depth

Who this book is for

This book is for Linux administrators who want to control the secure state of their systems. It's packed with the latest information on SELinux operations and administrative procedures so you'll be able to further harden your system through mandatory access control (MAC) – a security strategy that has been shaping Linux security for years.

Table of contents

  1. SELinux System Administration - Second Edition
    1. SELinux System Administration - Second Edition
    2. Credits
    3. About the Author
    4. About the Reviewers
    5. www.PacktPub.com
      1. Why subscribe?
    6. Preface
      1. What this book covers 
      2. What you need for this book 
      3. Who this book is for
      4. Conventions  
      5. Reader feedback
      6. Customer support
        1. Errata
        2. Piracy
        3. Questions
    7. 1. Fundamental SELinux Concepts
      1. Providing more security to Linux
        1. Using Linux security modules
        2. Extending regular DAC with SELinux
        3. Restricting root privileges
        4. Reducing the impact of vulnerabilities
        5. Enabling SELinux support
      2. Labeling all resources and objects
        1. Dissecting the SELinux context
        2. Enforcing access through types
        3. Granting domain access through roles
        4. Limiting roles through users
        5. Controlling information flow through sensitivities
      3. Defining and distributing policies
        1. Writing SELinux policies
        2. Distributing policies through modules
        3. Bundling modules in a policy store
      4. Distinguishing between policies
        1. Supporting MLS
        2. Dealing with unknown permissions
        3. Supporting unconfined domains
        4. Limiting cross-user sharing
        5. Incrementing policy versions
        6. Different policy content
      5. Summary
    8. 2. Understanding SELinux Decisions and Logging
      1. Switching SELinux on and off
        1. Setting the global SELinux state
        2. Switching to permissive (or enforcing) mode
        3. Using kernel boot parameters
        4. Disabling SELinux protections for a single service
        5. Understanding SELinux-aware applications
      2. SELinux logging and auditing
        1. Following audit events
        2. Uncovering more logging
        3. Configuring Linux auditing
        4. Configuring the local system logger
        5. Reading SELinux denials
        6. Other SELinux-related event types
          1. USER_AVC
          2. SELINUX_ERR
          3. MAC_POLICY_LOAD
          4. MAC_CONFIG_CHANGE
          5. MAC_STATUS
          6. NetLabel events
          7. Labeled IPsec events
        7. Using ausearch
      3. Getting help with denials
        1. Troubleshooting with setroubleshoot
        2. Sending e-mails when SELinux denials occur
        3. Using audit2why
        4. Interacting with systemd-journal
        5. Using common sense
      4. Summary
    9. 3. Managing User Logins
      1. User-oriented SELinux contexts
        1. Understanding domain complexity
        2. Querying for unconfined domains
      2. SELinux users and roles
        1. Listing SELinux user mappings
        2. Mapping logins to SELinux users
        3. Customizing logins towards services
        4. Creating SELinux users
        5. Listing accessible domains
        6. Managing categories
      3. Handling SELinux roles
        1. Defining allowed SELinux contexts
        2. Validating contexts with getseuser
        3. Switching roles with newrole
        4. Managing role access through sudo
        5. Reaching other domains using runcon
        6. Switching to the system role
      4. SELinux and PAM
        1. Assigning contexts through PAM
        2. Prohibiting access during permissive mode
        3. Polyinstantiating directories
      5. Summary
    10. 4. Process Domains and File-Level Access Controls
      1. About SELinux file contexts
        1. Getting context information
        2. Interpreting SELinux context types
      2. Keeping or ignoring contexts
        1. Inheriting the default context
        2. Querying transition rules
        3. Copying and moving files
        4. Temporarily changing file contexts
        5. Placing categories on files and directories
        6. Using multilevel security on files
        7. Backing up and restoring extended attributes
        8. Using mount options to set SELinux contexts
      3. SELinux file context expressions
        1. Using context expressions
        2. Registering file context changes
        3. Using customizable types
        4. Compiling the different file_contexts files
        5. Exchanging local modifications
      4. Modifying file contexts
        1. Using setfiles, rlpkg, and fixfiles
        2. Relabeling the entire file system
        3. Automatically setting contexts with restorecond
      5. The context of a process
        1. Getting a process context
        2. Transitioning towards a domain
        3. Verifying a target context
        4. Other supported transitions
        5. Querying initial contexts
      6. Limiting the scope of transitions
        1. Sanitizing environments on transition
        2. Disabling unconstrained transitions
        3. Using Linux's NO_NEW_PRIVS
      7. Types, permissions, and constraints
        1. Understanding type attributes
        2. Querying domain permissions
        3. Learning about constraints
      8. Summary
    11. 5. Controlling Network Communications
      1. From IPC to TCP and UDP sockets
        1. Using shared memory
        2. Communicating locally through pipes
        3. Conversing over UNIX domain sockets
        4. Understanding netlink sockets
        5. Dealing with TCP and UDP sockets
        6. Listing connection contexts
      2. Linux netfilter and SECMARK support
        1. Introducing netfilter
        2. Implementing security markings
        3. Assigning labels to packets
      3. Labeled networking
        1. Fallback labeling with NetLabel
        2. Limiting flows based on the network interface
        3. Accepting peer communication from selected hosts
        4. Verifying peer-to-peer flow
        5. Using old-style controls
      4. Labeled IPsec
        1. Setting up regular IPsec
        2. Enabling labeled IPsec
        3. Using Libreswan
      5. NetLabel/CIPSO
        1. Configuring CIPSO mappings
        2. Adding domain-specific mappings
        3. Using local CIPSO definitions
        4. Supporting IPv6 CALIPSO
      6. Summary
    12. 6. sVirt and Docker Support
      1. SELinux-secured virtualization
        1. Introducing virtualization
        2. Reviewing the risks of virtualization
        3. Using nondynamic security models
        4. Reusing existing virtualization domains
        5. Understanding MCS
      2. libvirt SELinux support
        1. Differentiating between shared and dedicated resources
        2. Assessing the libvirt architecture
        3. Configuring libvirt for sVirt
        4. Using static labels
        5. Customizing labels
        6. Using different storage pool locations
        7. Interpreting output-only label information
        8. Controlling available categories
        9. Limiting supported hosts in a cluster
        10. Modifying default contexts
      3. Securing Docker containers
        1. Understanding container security
        2. Controlling non-sVirt Docker SELinux integration
        3. Aligning Docker security with sVirt
        4. Limiting container capabilities
        5. Using different SELinux contexts
        6. Relabeling volume mounts
        7. Lowering SELinux controls for specific containers
        8. Modifying default contexts
      4. Summary
    13. 7. D-Bus and systemd
      1. The system daemon (systemd)
      2. Service support in systemd
        1. Understanding unit files
        2. Setting the SELinux context for a service
        3. Using transient services
        4. Requiring SELinux for a service
        5. Relabeling files during service startup
        6. Using socket-based activation
        7. Governing unit operations access
      3. Logging with systemd
        1. Retrieving SELinux-related information
        2. Querying logs given a SELinux context
        3. Using setroubleshoot integration with journal
      4. Using systemd containers
        1. Initializing a systemd container
        2. Using a specific SELinux context
      5. Handling device files
        1. Using udev rules
        2. Setting a SELinux label on a device node
      6. D-Bus communication
        1. Understanding D-Bus
        2. Controlling service acquisition with SELinux
        3. Governing message flows
      7. Summary
    14. 8. Working with SELinux Policies
      1. SELinux booleans
        1. Listing SELinux booleans
        2. Changing boolean values
        3. Inspecting the impact of a boolean
      2. Enhancing SELinux policies
        1. Listing policy modules
        2. Loading and removing policy modules
        3. Creating policies using audit2allow
        4. Using sensible module names
        5. Using refpolicy macros with audit2allow
        6. Using selocal
      3. Creating custom modules
        1. Building SELinux native modules
        2. Building reference policy modules
        3. Building CIL policy modules
        4. Adding file context definitions
      4. Creating roles and user domains
        1. Creating the pgsql_admin.te file
        2. Creating the user rights
        3. Granting interactive shell access
        4. Generating skeleton user policy files
      5. Creating new application domains
        1. Creating the mojomojo.* files
        2. Creating policy interfaces
        3. Generating skeleton application policy files
      6. Replacing existing policies
        1. Replacing RHEL policies
        2. Replacing Gentoo policies
      7. Other uses of policy enhancements
        1. Creating customized SECMARK types
        2. Auditing access attempts
        3. Creating customizable types
      8. Summary
    15. 9. Analyzing Policy Behavior
      1. Single-step analysis
        1. Using different SELinux policy files
        2. Displaying policy object information
        3. Understanding sesearch
        4. Querying allow rules
        5. Querying type transition rules
        6. Querying other type rules
        7. Querying role related rules
        8. Browsing with apol
      2. Domain transition analysis
        1. Using apol for domain transition analysis
        2. Using sedta for domain transition analysis
      3. Information flow analysis
        1. Using apol for information flow analysis
        2. Using seinfoflow for information flow analysis
      4. Other policy analysis
        1. Comparing policies with sediff
        2. Analyzing policies with sepolicy
      5. Summary
    16. 10. SELinux Use Cases
      1. Hardening web servers
        1. Describing the situation
        2. Configuring for a multi-instance setup
        3. Creating the SELinux categories
        4. Choosing the right contexts
        5. Enabling administrative accounts
        6. Handling web server behavior
        7. Dealing with content updates
        8. Tuning the network and firewall rules
      2. Securing shell services
        1. Splitting SSH over multiple instances
        2. Updating the network rules
        3. Configuring for chrooted access
        4. Associating SELinux mappings based on access
        5. Tuning SSH SELinux rules
        6. Enabling multi-tenancy on the user level
      3. File sharing through NFS
        1. Setting up basic NFS
        2. Enabling NFS support
        3. Tuning the NFS SELinux rules
        4. Using context mounts
        5. Working with labeled NFS
        6. Comparing Samba with NFS
      4. Summary

Product information

  • Title: SELinux System Administration - Second Edition
  • Author(s): Sven Vermeulen
  • Release date: December 2016
  • Publisher(s): Packt Publishing
  • ISBN: 9781787126954