book

SELinux

by Bill McCarty

October 2004

Intermediate to advanced

256 pages

8h 16m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Organization of This Book
Keyboard Accelerators
Software Threats and the InternetSoftware complexityNetwork connectivityActive content and mobile codePrivilege EscalationThe Patch Cycle and the 0-Day ProblemProtecting Against 0-DaysNetwork and Host DefensesNetwork defensesNetwork firewallsNetwork intrusion detection and prevention systemsHost defensesHost firewalls and intrusion detection systemsLogging and auditingMemory protectionSandboxesAccess-control listsDiscretionary and Mandatory Access ControlDiscretionary access controlMandatory access control
How SELinux WorksSELinux Components and Linux Security Modules (LSM)

Mailing Lists
Subjects and Objects
Kernel-Level CodeThe SELinux Shared LibraryThe SELinux Security PolicySELinux ToolsSELinux commandsModified Linux commands and programsSupplementary SELinux toolsReferences
SELinux Versions
Fedora Core 2
Debian GNU/LinuxGentoo LinuxInstalling SELinux to a fresh Gentoo systemInstalling SELinux to an existing Gentoo Linux systemRPM-Based DistributionsRed Hat Enterprise LinuxSUSE Linux
System Modes and SELinux Tuning
Switching ModesSetting the initial operating modeDynamically setting the operating modeDisabling SELinux at boot timeLoading the SELinux Security PolicyThe SELinux MakefileThe SELinux policy compiler (checkpolicy)The load_policy utilityLabeling Filesystems and FilesUsing the Makefile to label or relabel filesystemsUsing commands to label or relabel files or filesystemsThe chcon utilityThe fixfiles utilityThe restorecon utilityThe setfiles utilityTuning Fedora Core 2 SELinuxTuning via macrosTuning via policy BooleansSetting Booleans via the /selinux filesystem
Entering a RoleChanging rolesViewing Security ContextsViewing the user security contextViewing a file security contextViewing a process security contextAdding UsersAssociating a user with a nondefault roleHow default roles are assignedSetting user passwordsStarting and Controlling DaemonsStarting non-init daemons and programs
SELinux Log Message FormatSELinux Logging SubtletiesThe Audit2allow Utility
Boot ProblemsLocal Login ProblemsProgram Execution ProblemsDaemon ProblemsX Problems
The SELinux Policy
The snort.fc FileThe snort.te FileThe type lineThe allow linesMacro invocations
The flask SubdirectoryThe flask/initial_sids fileThe flask/security_classes fileThe flask/access_vectors fileThe macros SubdirectoryThe file_contexts SubdirectoryThe types SubdirectoryThe domains SubdirectoryThe appconfig SubdirectoryThe Policy Source Directory
The SELinux Role-Based Access Control Model
What Railroad Diagrams DoHow Railroad Diagrams Work
Basic Policy Elements
Role Type DeclarationsRole Dominance DeclarationsRole Transition DeclarationsRole Allow Declarations
The SELinux Type-Enforcement Model
Type DeclarationsType-Alias DeclarationsAttribute DeclarationsTE Access-Vector DeclarationsSpecial notations for types, classes, and permissionsMacros that specify and authorize transitionsTransition DeclarationsBoolean DeclarationsConditional Declarations
Constraint Declarations
Syntax of Initial SID Context DeclarationsSyntax of Filesystem Labeling DeclarationsSyntax of Genfs DeclarationsSyntax of Network DeclarationsPortcon declarationsNetifcon declarationsNodecon declarations
Syntax of security_classesSyntax of initial_sidsSyntax of access_vectors
The SELinux Policy Source Tree
Adding a System AdministratorAdding an Ordinary User
Determine What Files Are Related to the DomainDetermine the Security Contexts of the FilesDecide on Appropriate Security Contexts for the New DomainCreate a Basic TE FileCreate a Basic FC FileDelete Conflicting Specifications from Other FC FilesLoad the Revised Policy and Label the DomainsTest and Revise the TE and FC Files as Needed
ApolPolicy componentsPolicy rulesAnalysisSeauditSepcutSeuserx

Content preview from SELinux

Policy Management Tools

Tresys Technology, a network services company, has published a set of open source GUI tools for SELinux policy management. Most releases of SELinux include at least one of the Tresys tools, which are:

Apol: Supports analysis of the SELinux policy.conf file.
Seaudit: Supports searching, sorting, and viewing AVC log messages.
Sepcut: Supports browsing and editing of SELinux policy components.
Seuserx: Supports adding, changing, and removing Linux and SELinux users.

The following subsections briefly describe these tools. My intention is not to show you how to use the tools but to help you understand what they do, so that you can decide when to use them and which tool to use. Because the tools are regularly improved, I advise you to refer to the tools’ help files for information on operating them. If your SELinux release does not include the Tresys tools, you can obtain them at http://www.tresys.com/.

Apol

The Apol tool enables you to analyze an SELinux policy. It does not work with the component files that compose the policy, but only with policy.conf. So you should compile the SELinux policy before using Apol. You can do so by issuing the command: