|
|
| (103 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| === Chapter 3. Targeted Policy ===
| | {{Navigation|Linux/SELinux/02 Kontext|Linux/SELinux/03 Default Policy/Prozesse}} |
| Targeted policy is the default SELinux policy used in Red Hat Enterprise Linux. When using targeted policy, processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. For example, by default, logged-in users run in the <code>unconfined_t</code> domain, and system processes started by init run in the <code>unconfined_service_t</code> domain; both of these domains are unconfined.
| | '''Linux/SELinux/03 Default Policy''' - Targeted Policy |
|
| |
|
| Executable and writable memory checks may apply to both confined and unconfined domains. However, by default, subjects running in an unconfined domain can allocate writable memory and execute it. These memory checks can be enabled by setting Booleans, which allow the SELinux policy to be modified at runtime. Boolean configuration is discussed later.
| | === Beschreibung === |
| | === Targeted Policy === |
| | Standard-Linux-SELinux-Richtlinie |
|
| |
|
| === 31. Confined Processes === | | ; Verwendung der Targeted Policy |
| Almost every service that listens on a network, such as <code>sshd</code> or <code>httpd</code>, is confined in Red Hat Enterprise Linux. Also, most processes that run as the root user and perform tasks for users, such as the <code>passwd</code> utility, are confined. When a process is confined, it runs in its own domain, such as the <code>httpd</code> process running in the <code>httpd_t</code> domain. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited.
| | {| class="wikitable options big" |
| | ! Policy !! Beschreibung |
| | |- |
| | | targeted || Prozesse, die als „targeted“ gekennzeichnet sind, laufen in einer eingeschränkten [[Domäne]] |
| | |- |
| | | not targeted || Prozesse, die nicht als „targeted“ gekennzeichnet sind, laufen in einer uneingeschränkten [[Domäne]] |
| | |} |
|
| |
|
| Complete this procedure to ensure that SELinux is enabled and the system is prepared to perform the following example:
| | ; Beispiel |
| | | {| class="wikitable options big" |
| '''Procedure 3.1. How to Verify SELinux Status'''# Confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used. The correct output should look similar to the output below:
| | ! Domäne |
| | | ! Beschreibung |
| ~]$ sestatus
| | |- |
| | | | unconfined_t |
| SELinux status: enabled
| | | Angemeldete Benutzer (standardmäßig) |
| | |
| SELinuxfs mount: /sys/fs/selinux
| |
| | |
| SELinux root directory: /etc/selinux
| |
| | |
| Loaded policy name: targeted
| |
| | |
| Current mode: enforcing
| |
| | |
| Mode from config file: enforcing
| |
| | |
| Policy MLS status: enabled
| |
| | |
| Policy deny_unknown status: allowed
| |
| | |
| Max kernel policy version: 30
| |
| | |
| See Section 4.4, “Permanent Changes in SELinux States and Modes” for detailed information about changing SELinux modes.
| |
| | |
| # As root, create a file in the <code>/var/www/html/</code> directory: ~]# touch /var/www/html/testfile
| |
| # Enter the following command to view the SELinux context of the newly created file: ~]$ ls -Z /var/www/html/testfile -rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/testfile By default, Linux users run unconfined in Red Hat Enterprise Linux, which is why the <code>testfile</code> file is labeled with the SELinux <code>unconfined_u</code> user. RBAC is used for processes, not files. Roles do not have a meaning for files; the <code>object_r</code> role is a generic role used for files (on persistent storage and network file systems). Under the <code>/proc</code> directory, files related to processes may use the <code>system_r</code> role. The <code>httpd_sys_content_t</code> type allows the <code>httpd</code> process to access this file.
| |
| | |
| The following example demonstrates how SELinux prevents the Apache HTTP Server (<code>httpd</code>) from reading files that are not correctly labeled, such as files intended for use by Samba. This is an example, and should not be used in production. It assumes that the httpd and wget packages are installed, the SELinux targeted policy is used, and that SELinux is running in enforcing mode.
| |
| | |
| '''Procedure 3.2. An Example of Confined Process'''# As root, start the <code>httpd</code> daemon:
| |
| | |
| ~]# systemctl start httpd.service
| |
| | |
| Confirm that the service is running. The output should include the information below (only the time stamp will differ):
| |
| | |
| ~]$ systemctl status httpd.service
| |
| | |
| httpd.service - The Apache HTTP Server
| |
| | |
| Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
| |
| | |
| Active: active (running) since Mon 2013-08-05 14:00:55 CEST; 8s ago
| |
| | |
| # Change into a directory where your Linux user has write access to, and enter the following command. Unless there are changes to the default configuration, this command succeeds: ~]$ wget http://localhost/testfile --2009-11-06 17:43:01-- http://localhost/testfile Resolving localhost... 127.0.0.1 Connecting to localhost|127.0.0.1|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 0 [text/plain] Saving to: `testfile'
| |
| | |
| [ <=> ] 0 --.-K/s in 0s
| |
| | |
| 2009-11-06 17:43:01 (0.00 B/s) - `testfile' saved [0/0]
| |
| | |
| # The <code>chcon</code> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <code>semanage</code> utility, which is discussed later. As root, enter the following command to change the type to a type used by Samba: ~]# chcon -t samba_share_t /var/www/html/testfile Enter the following command to view the changes: ~]$ ls -Z /var/www/html/testfile -rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile
| |
| # Note that the current DAC permissions allow the <code>httpd</code> process access to <code>testfile</code>. Change into a directory where your user has write access to, and enter the following command. Unless there are changes to the default configuration, this command fails: ~]$ wget http://localhost/testfile --2009-11-06 14:11:23-- http://localhost/testfile Resolving localhost... 127.0.0.1 Connecting to localhost|127.0.0.1|:80... connected. HTTP request sent, awaiting response... 403 Forbidden 2009-11-06 14:11:23 ERROR 403: Forbidden.
| |
| # As root, remove <code>testfile</code>: ~]# rm -i /var/www/html/testfile
| |
| # If you do not require <code>httpd</code> to be running, as root, enter the following command to stop it: ~]# systemctl stop httpd.service
| |
| | |
| This example demonstrates the additional security added by SELinux. Although DAC rules allowed the <code>httpd</code> process access to <code>testfile</code> in step 2, because the file was labeled with a type that the <code>httpd</code> process does not have access to, SELinux denied access.
| |
| | |
| If the <code>auditd</code> daemon is running, an error similar to the following is logged to <code>/var/log/audit/audit.log</code>:
| |
| | |
| type=AVC msg=audit(1220706212.937:70): avc: denied { getattr } for pid=1904 comm="httpd" path="/var/www/html/testfile" dev=sda5 ino=247576 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
| |
| | |
| type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 success=no exit=-13 a0=b9e21da0 a1=bf9581dc a2=555ff4 a3=2008171 items=0 ppid=1902 pid=1904 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
| |
| | |
| Also, an error similar to the following is logged to <code>/var/log/httpd/error_log</code>:
| |
| | |
| [Wed May 06 23:00:54 2009] [error] [client ''127.0.0.1''] (13)Permission denied: access to /testfile denied
| |
| | |
| === 3.2. Unconfined Processes ===
| |
| Unconfined processes run in unconfined domains, for example, unconfined services executed by <code>init</code> end up running in the <code>unconfined_service_t</code> domain, unconfined services executed by kernel end up running in the <code>kernel_t</code> domain, and unconfined services executed by unconfined Linux users end up running in the <code>unconfined_t</code> domain. For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules – it does not replace them.
| |
| | |
| To ensure that SELinux is enabled and the system is prepared to perform the following example, complete the Procedure 3.1, “How to Verify SELinux Status” described in Section 3.1, “Confined Processes”.
| |
| | |
| The following example demonstrates how the Apache HTTP Server (<code>httpd</code>) can access data intended for use by Samba, when running unconfined. Note that in Red Hat Enterprise Linux, the <code>httpd</code> process runs in the confined <code>httpd_t</code> domain by default. This is an example, and should not be used in production. It assumes that the httpd, wget, dbus and audit packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode.
| |
| | |
| '''Procedure 3.3. An Example of Unconfined Process'''# The <code>chcon</code> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <code>semanage</code> utility, which is discussed later. As the root user, enter the following command to change the type to a type used by Samba:
| |
| | |
| ~]# chcon -t samba_share_t /var/www/html/testfile
| |
| | |
| View the changes:
| |
| | |
| ~]$ ls -Z /var/www/html/testfile
| |
| | |
| -rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile
| |
| | |
| # Enter the following command to confirm that the <code>httpd</code> process is not running: ~]$ systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: inactive (dead) If the output differs, enter the following command as root to stop the <code>httpd</code> process: ~]# systemctl stop httpd.service
| |
| # To make the <code>httpd</code> process run unconfined, enter the following command as root to change the type of the <code>/usr/sbin/httpd</code> file, to a type that does not transition to a confined domain: ~]# chcon -t bin_t /usr/sbin/httpd
| |
| # Confirm that <code>/usr/sbin/httpd</code> is labeled with the <code>bin_t</code> type: ~]$ ls -Z /usr/sbin/httpd -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/sbin/httpd
| |
| # As root, start the <code>httpd</code> process and confirm, that it started successfully: ~]# systemctl start httpd.service ~]# systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: active (running) since Thu 2013-08-15 11:17:01 CEST; 5s ago
| |
| | |
| # Enter the following command to view <code>httpd</code> running in the <code>unconfined_service_t</code> domain: ~]$ ps -eZ | grep httpd system_u:system_r:unconfined_service_t:s0 11884 ? 00:00:00 httpd system_u:system_r:unconfined_service_t:s0 11885 ? 00:00:00 httpd system_u:system_r:unconfined_service_t:s0 11886 ? 00:00:00 httpd system_u:system_r:unconfined_service_t:s0 11887 ? 00:00:00 httpd system_u:system_r:unconfined_service_t:s0 11888 ? 00:00:00 httpd system_u:system_r:unconfined_service_t:s0 11889 ? 00:00:00 httpd
| |
| | |
| # Change into a directory where your Linux user has write access to, and enter the following command. Unless there are changes to the default configuration, this command succeeds: ~]$ wget http://localhost/testfile --2009-05-07 01:41:10-- http://localhost/testfile Resolving localhost... 127.0.0.1 Connecting to localhost|127.0.0.1|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 0 [text/plain] Saving to: `testfile'
| |
| | |
| [ <=> ]--.-K/s in 0s
| |
| | |
| 2009-05-07 01:41:10 (0.00 B/s) - `testfile' saved [0/0]
| |
| | |
| Although the <code>httpd</code> process does not have access to files labeled with the <code>samba_share_t</code> type, <code>httpd</code> is running in the unconfined <code>unconfined_service_t</code> domain, and falls back to using DAC rules, and as such, the <code>wget</code> command succeeds. Had <code>httpd</code> been running in the confined <code>httpd_t</code> domain, the <code>wget</code> command would have failed.
| |
| | |
| # The <code>restorecon</code> utility restores the default SELinux context for files. As root, enter the following command to restore the default SELinux context for <code>/usr/sbin/httpd</code>: ~]# restorecon -v /usr/sbin/httpd restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_exec_t:s0->system_u:object_r:httpd_exec_t:s0
| |
| | |
| Confirm that <code>/usr/sbin/httpd</code> is labeled with the <code>httpd_exec_t</code> type:
| |
| | |
| ~]$ ls -Z /usr/sbin/httpd -rwxr-xr-x root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd
| |
| | |
| # As root, enter the following command to restart <code>httpd</code>. After restarting, confirm that <code>httpd</code> is running in the confined <code>httpd_t</code> domain: ~]# systemctl restart httpd.service ~]$ ps -eZ | grep httpd system_u:system_r:httpd_t:s0 8883 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 8884 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 8885 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 8886 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 8887 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 8888 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 8889 ? 00:00:00 httpd
| |
| # As root, remove <code>testfile</code>: ~]# rm -i /var/www/html/testfile rm: remove regular empty file `/var/www/html/testfile'? y
| |
| # If you do not require <code>httpd</code> to be running, as root, enter the following command to stop <code>httpd</code>: ~]# systemctl stop httpd.service
| |
| | |
| The examples in these sections demonstrate how data can be protected from a compromised confined-process (protected by SELinux), as well as how data is more accessible to an attacker from a compromised unconfined-process (not protected by SELinux).
| |
| | |
| === 3.3. Confined and Unconfined Users ===
| |
| Each Linux user is mapped to an SELinux user using SELinux policy. This allows Linux users to inherit the restrictions on SELinux users. This Linux user mapping is seen by running the <code>semanage login -l</code> command as root:
| |
| | |
| ~]# semanage login -l
| |
| | |
| Login Name SELinux User MLS/MCS Range Service
| |
| | |
| __default__ unconfined_u s0-s0:c0.c1023 <nowiki>*</nowiki> root unconfined_u s0-s0:c0.c1023 <nowiki>*</nowiki> system_u system_u s0-s0:c0.c1023 <nowiki>*</nowiki>
| |
| | |
| In Red Hat Enterprise Linux, Linux users are mapped to the SELinux <code>__default__</code> login by default, which is mapped to the SELinux <code>unconfined_u</code> user. The following line defines the default mapping:
| |
| | |
| __default__ unconfined_u s0-s0:c0.c1023
| |
| | |
| The following procedure demonstrates how to add a new Linux user to the system and how to map that user to the SELinux <code>unconfined_u</code> user. It assumes that the root user is running unconfined, as it does by default in Red Hat Enterprise Linux:
| |
| | |
| '''Procedure 3.4. Mapping a New Linux User to the SELinux <code>unconfined_u</code> User'''# As root, enter the following command to create a new Linux user named <code>newuser</code>:
| |
| | |
| ~]# useradd newuser
| |
| | |
| # To assign a password to the Linux <code>newuser</code> user. Enter the following command as root: ~]# passwd newuser Changing password for user newuser. New UNIX password: ''Enter a password'' Retype new UNIX password: ''Enter the same password again'' passwd: all authentication tokens updated successfully.
| |
| # Log out of your current session, and log in as the Linux <code>newuser</code> user. When you log in, the '''pam_selinux''' PAM module automatically maps the Linux user to an SELinux user (in this case, <code>unconfined_u</code>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Enter the following command to view the context of a Linux user: [newuser@localhost ~]$ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 '''Note''' If you no longer need the <code>newuser</code> user on your system, log out of the Linux <code>newuser</code>'s session, log in with your account, and run the <code>userdel -r newuser</code> command as root. It will remove <code>newuser</code> along with their home directory.
| |
| | |
| Confined and unconfined Linux users are subject to executable and writable memory checks, and are also restricted by MCS or MLS.
| |
| | |
| To list the available SELinux users, enter the following command:
| |
| | |
| ~]$seinfo -u Users: 8
| |
| sysadm_u
| |
| system_u
| |
| xguest_u
| |
| root
| |
| guest_u
| |
| staff_u
| |
| user_u
| |
| unconfined_u
| |
| Note that the <code>seinfo</code> command is provided by the setools-console package, which is not installed by default.
| |
| | |
| If an unconfined Linux user executes an application that SELinux policy defines as one that can transition from the <code>unconfined_t</code> domain to its own confined domain, the unconfined Linux user is still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined. Therefore, the exploitation of a flaw in the application can be limited by the policy.
| |
| | |
| Similarly, we can apply these checks to confined users. Each confined Linux user is restricted by a confined user domain. The SELinux policy can also define a transition from a confined user domain to its own target confined domain. In such a case, confined Linux users are subject to the restrictions of that target confined domain. The main point is that special privileges are associated with the confined users according to their role. In the table below, you can see examples of basic confined domains for Linux users in Red Hat Enterprise Linux:
| |
| | |
| Table 3.1. SELinux User Capabilities
| |
| {| style="border-spacing:0;width:17cm;" | |
| ! align="center" |User | |
| ! align="center" |Role | |
| ! align="center" |Domain
| |
| ! align="center" |X Window System
| |
| ! align="center" |su or sudo
| |
| ! align="center" |Execute in home directory and /tmp (default)
| |
| ! align="center" |Networking
| |
| |- style="border:none;padding:0.049cm;"
| |
| |sysadm_u
| |
| |sysadm_r
| |
| |sysadm_t
| |
| |yes
| |
| |'''su''' and '''sudo'''
| |
| |yes
| |
| |yes
| |
| |- style="border:none;padding:0.049cm;"
| |
| |staff_u
| |
| |staff_r
| |
| |staff_t
| |
| |yes
| |
| |only '''sudo'''
| |
| |yes
| |
| |yes
| |
| |- style="border:none;padding:0.049cm;"
| |
| |user_u
| |
| |user_r
| |
| |user_t
| |
| |yes
| |
| |no
| |
| |yes
| |
| |yes
| |
| |- style="border:none;padding:0.049cm;"
| |
| |guest_u
| |
| |guest_r
| |
| |guest_t
| |
| |no
| |
| |no
| |
| |yes
| |
| |no
| |
| |- style="border:none;padding:0.049cm;"
| |
| |xguest_u
| |
| |xguest_r
| |
| |xguest_t
| |
| |yes
| |
| |no
| |
| |yes
| |
| |Firefox only
| |
| |- | | |- |
| | | unconfined_service_t |
| | | Von init gestartete Systemprozesse |
| |} | | |} |
| | Beide Domänen sind '''[[SELinux/unconfined|unconfined]]''' |
|
| |
|
| * Linux users in the <code>user_t</code>, <code>guest_t</code>, and <code>xguest_t</code> domains can only run set user ID (setuid) applications if SELinux policy permits it (for example, <code>passwd</code>). These users cannot run the <code>su</code> and <code>sudo</code> setuid applications, and therefore cannot use these applications to become root.
| | === Speicherprüfungen === |
| * Linux users in the <code>sysadm_t</code>, <code>staff_t</code>, <code>user_t</code>, and <code>xguest_t</code> domains can log in using the X Window System and a terminal.
| | Prüfungen auf ausführbaren und beschreibbaren Speicher |
| * By default, Linux users in the <code>staff_t</code>, <code>user_t</code>, <code>guest_t</code>, and <code>xguest_t</code> domains can execute applications in their home directories and <code>/tmp</code>. To prevent them from executing applications, which inherit users' permissions, in directories they have write access to, set the <code>guest_exec_content</code> and <code>xguest_exec_content</code>booleans to <code>off</code>. This helps prevent flawed or malicious applications from modifying users' files. See Section 6.6, “Booleans for Users Executing Applications” for information about allowing and preventing users from executing applications in their home directories and <code>/tmp</code>.
| |
| * The only network access Linux users in the <code>xguest_t</code> domain have is '''Firefox''' connecting to web pages.
| |
| | |
| Note that <code>system_u</code> is a special user identity for system processes and objects. It must never be associated to a Linux user. Also, <code>unconfined_u</code> and <code>root</code> are unconfined users. For these reasons, they are not included in the aforementioned table of SELinux user capabilities.
| |
| | |
| Alongside with the already mentioned SELinux users, there are special roles, that can be mapped to those users. These roles determine what SELinux allows the user to do: * <code>webadm_r</code> can only administrate SELinux types related to the Apache HTTP Server. See Section 13.2, “Types” for further information.
| |
| | |
| * <code>dbadm_r</code> can only administrate SELinux types related to the MariaDB database and the PostgreSQL database management system. See Section 20.2, “Types” and Section 21.2, “Types” for further information.
| |
| * <code>logadm_r</code> can only administrate SELinux types related to the <code>syslog</code> and <code>auditlog</code> processes.
| |
| * <code>secadm_r</code> can only administrate SELinux.
| |
| * <code>auditadm_r</code> can only administrate processes related to the <code>audit</code> subsystem.
| |
| | |
| To list all available roles, enter the following command:
| |
| | |
| ~]$ seinfo -r
| |
| | |
| As mentioned before, the <code>seinfo</code> command is provided by the setools-console package, which is not installed by default.
| |
| | |
| ==== 3.3.1. The sudo Transition and SELinux Roles ==== | |
| In certain cases, confined users need to perform an administrative task that require root privileges. To do so, such a confined user has to gain a ''confined administrator'' SELinux role using the <code>sudo</code> command. The <code>sudo</code> command is used to give trusted users administrative access. When users precede an administrative command with <code>sudo</code>, they are prompted for their ''own'' password. Then, when they have been authenticated and assuming that the command is permitted, the administrative command is executed as if they were the root user.
| |
| | |
| As shown in Table 3.1, “SELinux User Capabilities”, only the <code>staff_u</code> and <code>sysadm_u</code> SELinux confined users are permitted to use <code>sudo</code> by default. When such users execute a command with <code>sudo</code>, their role can be changed based on the rules specified in the <code>/etc/sudoers</code> configuration file or in a respective file in the <code>/etc/sudoers.d/</code> directory if such a file exists.
| |
| | |
| For more information about <code>sudo</code>, see the ''Gaining Privileges'' section in the Red Hat Enterprise Linux 7 System Administrator's Guide.
| |
| | |
| '''Procedure 3.5. Configuring the sudo Transition'''
| |
| | |
| This procedure shows how to set up <code>sudo</code> to transition a newly-created ''SELinux_user_u'' confined user from a ''default_role_r'' to an ''administrator_r'' administrator role.
| |
| | |
| '''Note'''
| |
| | |
| To configure a confined administrator role for an already existing SELinux user, skip the first two steps. # Create a new SELinux user and specify the default SELinux role and a supplementary confined administrator role for this user:
| |
| | |
| ~]# semanage user -a -r s0-s0:c0.c1023 -R "''default_role_r'' ''administrator_r''" ''SELinux_user_u''
| |
|
| |
|
| # Set up the default SElinux policy context file. For example, to have the same SELinux rules as the <code>staff_u</code> SELinux user, copy the <code>staff_u</code> context file: ~]# cp /etc/selinux/targeted/contexts/users/staff_u /etc/selinux/targeted/contexts/users/''SELinux_user_u''
| | * Können für eingeschränkte und für unconfined Domänen gelten |
| # Map the newly-created SELinux user to an existing Linux user: semanage login -a -s ''SELinux_user_u'' -rs0:c0.c1023 ''linux_user''
| |
| # Create a new configuration file with the same name as your Linux user in the <code>/etc/sudoers.d/</code> directory and add the following string to it: ~]# echo "''linux_user'' ALL=(ALL) TYPE=''administrator_t'' ROLE=''administrator_r'' /bin/bash " > /etc/sudoers.d/''linux_user''
| |
| # Use the <code>restorecon</code> utility to relabel the ''linux_user'' home directory: ~]# restorecon -FR -v /home/''linux_user''
| |
| # Log in to the system as the newly-created Linux user and check that the user is labeled with the default SELinux role: ~]$ id -Z ''SELinux_user_u'':''default_role_r'':''SELinux_user_t'':s0:c0.c1023
| |
| # Run <code>sudo</code> to change the user's SELinux context to the supplementary SELinux role as specified in <code>/etc/sudoers.d/''linux_user''</code>. The <code>-i</code> option used with <code>sudo</code> causes that an interactive shell is executed: ~]$ sudo -i ~]# id -Z ''SELinux_user_u'':''administrator_r'':''administrator_t'':s0:c0.c1023
| |
|
| |
|
| To better understand the placeholders, such as ''default_role_r'' or ''administrator_r'', see the following example.
| | * Standardmäßig können Subjekte, die in einer unconfined Domäne laufen, jedoch beschreibbaren Speicher zuweisen und diesen ausführen |
| | Speicherprüfungen können durch das Setzen von [[Booleschen Werten]] aktiviert werden, wodurch die SELinux-Richtlinie zur Laufzeit geändert werden kann |
|
| |
|
| '''Example 3.1. Configuring the sudo Transition'''
| | <noinclude> |
| | == Anhang == |
| | === Siehe auch === |
| | ; Unterseiten |
| | {{Special:PrefixIndex/{{BASEPAGENAME}}/}} |
|
| |
|
| This example creates a new SELinux user <code>confined_u</code> with default assigned role <code>staff_r</code> and with <code>sudo</code> configured to change the role of <code>confined_u</code> from <code>staff_r</code> to <code>webadm_r</code>. * Enter all the following commands as the root user in the <code>sysadm_r</code> or <code>unconfined_r</code> role.
| | ; Inhalt der Kategorie Linux/SELinux |
| | <div style="column-count:2"> |
| | <categorytree hideroot=on mode="pages">Linux/SELinux</categorytree> |
| | </div> |
|
| |
|
| ~]# semanage user -a -r s0-s0:c0.c1023 -R "staff_r webadm_r" confined_u
| | === Dokumentation === |
| | <!-- |
| | ; Man-Page |
| | # [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)] |
|
| |
|
| ~]# cp /etc/selinux/targeted/contexts/users/staff_u /etc/selinux/targeted/contexts/users/confined_u
| | ; Info-Pages |
| | --> |
|
| |
|
| ~]# semanage login -a -s confined_u -rs0:c0.c1023 linux_user
| | === Links === |
| | ==== Projekt ==== |
| | ==== Weblinks ==== |
|
| |
|
| ~]# restorecon -FR -v /home/linux_user
| | <!-- |
| | {{DEFAULTSORT:new}} |
| | {{DISPLAYTITLE:new}} |
| | --> |
|
| |
|
| ~]# echo "''linux_user'' ALL=(ALL) ROLE=webadm_r TYPE=webadm_t /bin/bash " > /etc/sudoers.d/linux_user
| |
|
| |
|
| * Log in to the system as the newly-created Linux user and check that the user is labeled with the default SELinux role: ~]$ id -Z confined_u:staff_r:staff_t:s0:c0.c1023 ~]$ sudo -i ~]# id -Z confined_u:webadm_r:webadm_t:s0:c0.c1023
| | [[Kategorie:Linux/SELinux]] |
| | [[Kategorie:Linux/SELinux/03]] |
|
| |
|
| [[Kategorie:SELinux/DOC]]
| | {{Navigation|Linux/SELinux/02 Kontext|Linux/SELinux/03 Default Policy/Prozesse}} |
| | </noinclude> |