book

SELinux

by Bill McCarty

October 2004

Intermediate to advanced

256 pages

8h 16m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Organization of This Book
Keyboard Accelerators
Software Threats and the InternetSoftware complexityNetwork connectivityActive content and mobile codePrivilege EscalationThe Patch Cycle and the 0-Day ProblemProtecting Against 0-DaysNetwork and Host DefensesNetwork defensesNetwork firewallsNetwork intrusion detection and prevention systemsHost defensesHost firewalls and intrusion detection systemsLogging and auditingMemory protectionSandboxesAccess-control listsDiscretionary and Mandatory Access ControlDiscretionary access controlMandatory access control
How SELinux WorksSELinux Components and Linux Security Modules (LSM)

Mailing Lists
Subjects and Objects
Kernel-Level CodeThe SELinux Shared LibraryThe SELinux Security PolicySELinux ToolsSELinux commandsModified Linux commands and programsSupplementary SELinux toolsReferences
SELinux Versions
Fedora Core 2
Debian GNU/LinuxGentoo LinuxInstalling SELinux to a fresh Gentoo systemInstalling SELinux to an existing Gentoo Linux systemRPM-Based DistributionsRed Hat Enterprise LinuxSUSE Linux
System Modes and SELinux Tuning
Switching ModesSetting the initial operating modeDynamically setting the operating modeDisabling SELinux at boot timeLoading the SELinux Security PolicyThe SELinux MakefileThe SELinux policy compiler (checkpolicy)The load_policy utilityLabeling Filesystems and FilesUsing the Makefile to label or relabel filesystemsUsing commands to label or relabel files or filesystemsThe chcon utilityThe fixfiles utilityThe restorecon utilityThe setfiles utilityTuning Fedora Core 2 SELinuxTuning via macrosTuning via policy BooleansSetting Booleans via the /selinux filesystem
Entering a RoleChanging rolesViewing Security ContextsViewing the user security contextViewing a file security contextViewing a process security contextAdding UsersAssociating a user with a nondefault roleHow default roles are assignedSetting user passwordsStarting and Controlling DaemonsStarting non-init daemons and programs
SELinux Log Message FormatSELinux Logging SubtletiesThe Audit2allow Utility
Boot ProblemsLocal Login ProblemsProgram Execution ProblemsDaemon ProblemsX Problems
The SELinux Policy
The snort.fc FileThe snort.te FileThe type lineThe allow linesMacro invocations
The flask SubdirectoryThe flask/initial_sids fileThe flask/security_classes fileThe flask/access_vectors fileThe macros SubdirectoryThe file_contexts SubdirectoryThe types SubdirectoryThe domains SubdirectoryThe appconfig SubdirectoryThe Policy Source Directory
The SELinux Role-Based Access Control Model
What Railroad Diagrams DoHow Railroad Diagrams Work
Basic Policy Elements
Role Type DeclarationsRole Dominance DeclarationsRole Transition DeclarationsRole Allow Declarations
The SELinux Type-Enforcement Model
Type DeclarationsType-Alias DeclarationsAttribute DeclarationsTE Access-Vector DeclarationsSpecial notations for types, classes, and permissionsMacros that specify and authorize transitionsTransition DeclarationsBoolean DeclarationsConditional Declarations
Constraint Declarations
Syntax of Initial SID Context DeclarationsSyntax of Filesystem Labeling DeclarationsSyntax of Genfs DeclarationsSyntax of Network DeclarationsPortcon declarationsNetifcon declarationsNodecon declarations
Syntax of security_classesSyntax of initial_sidsSyntax of access_vectors
The SELinux Policy Source Tree
Adding a System AdministratorAdding an Ordinary User
Determine What Files Are Related to the DomainDetermine the Security Contexts of the FilesDecide on Appropriate Security Contexts for the New DomainCreate a Basic TE FileCreate a Basic FC FileDelete Conflicting Specifications from Other FC FilesLoad the Revised Policy and Label the DomainsTest and Revise the TE and FC Files as Needed
ApolPolicy componentsPolicy rulesAnalysisSeauditSepcutSeuserx

Content preview from SELinux

The Road Ahead

Having completed this chapter, you know quite a bit about SELinux and typical SELinux policies. If you’re content to run only relatively popular applications and prefer to rely on others for assistance in troubleshooting and fixing the occasional problems that you’re likely to run into when using SELinux, you’ll know pretty much all you need to know.

But typical Linux users are seldom so complacent. Those that desire even greater control over their computing affairs have merely begun to learn what they need to know about SELinux. This book has covered the fundamentals. But the SELinux policy is a sophisticated software unit whose mastery demands significant study and experimentation. Moreover, SELinux is still a relatively new software product and is constantly undergoing change. So in working with SELinux, you should anticipate that you will encounter many interesting puzzles and challenges. If you resemble the typical Linux user, you’ll enjoy tackling and overcoming these. You should also anticipate that your growing SELinux expertise will enable you to better secure your systems and applications, which should help you—and your management—sleep more soundly.

SELinux and the SELinux sample policy are powerful tools for securing systems. But like other security tools, their proper installation and ongoing use demand significant expertise. From this book, you can learn how SELinux works and the syntax and semantics of the SELinux policy language. But mastery of SELinux ...