Zum Inhalt springen

Linux/SELinux/01 Grundlagen: Unterschied zwischen den Versionen

Aus Foxwiki
Versionsgeschichte interaktiv durchsuchen
← Zum vorherigen VersionsunterschiedZum nächsten Versionsunterschied →
Dirkwagner (Diskussion | Beiträge)
Bürokraten, Oberflächenadministratoren, Administratoren
141.994 Bearbeitungen
VisuellWikitext
Keine Bearbeitungszusammenfassung
Markierung: Zurückgesetzt
Keine Bearbeitungszusammenfassung
Markierung: Manuelle Zurücksetzung
Zeile 1: Zeile 1:
=== Working with SELinux ===
'''SELinux/DOC/01 Einführung'''
The following sections give a brief overview of the main SELinux packages in Red Hat Enterprise Linux; installing and updating packages; which log files are used; the main SELinux configuration file; enabling and disabling SELinux; SELinux modes; configuring Booleans; temporarily and persistently changing file and directory labels; overriding file system labels with the [[mount]] command; mounting NFS volumes; and how to preserve SELinux contexts when copying and archiving files and directories.


=== 4.1. SELinux Packages ===
== Beschreibung ==
In Red Hat Enterprise Linux full installation, the SELinux packages are installed by default unless they are manually excluded during installation. If performing a minimal installation in text mode, the policycoreutils-python and the policycoreutils-gui package are not installed by default. Also, by default, SELinux runs in enforcing mode and the SELinux targeted policy is used. The following SELinux packages are installed on your system by default: * policycoreutils provides utilities such as [[restorecon]], [[secon]], [[setfiles]], [[semodule]], [[load_policy]], and [[setsebool]], for operating and managing SELinux.
; Was ist SELinux?
* selinux-policy provides a basic directory structure, the [[selinux-policy.conf]] file, and RPM macros.
* [[SELinux]] bietet eine zusätzliche Ebene der Systemsicherheit
* selinux-policy-targeted provides the SELinux targeted policy.
* libselinux – provides an API for SELinux applications.
* libselinux-utils provides the [[avcstat]], [[getenforce]], [[getsebool]], [[matchpathcon]], [[selinuxconlist]], [[selinuxdefcon]], [[selinuxenabled]], and [[setenforce]] utilities.
* libselinux-python provides Python bindings for developing SELinux applications.


The following packages are not installed by default but can be optionally installed by running the [[yum&nbsp;install&nbsp;''<package-name>'']] command: * selinux-policy-devel provides utilities for creating a custom SELinux policy and policy modules.
; SELinux beantwortet im Wesentlichen die Frage:
* selinux-policy-doc provides manual pages that describe how to configure SELinux altogether with various services.
: „Darf <Subjekt> die <Aktion> an <Objekt> ausführen?“
* selinux-policy-mls provides the MLS (Multi-Level Security) SELinux policy.
* setroubleshoot-server translates denial messages, produced when access is denied by SELinux, into detailed descriptions that can be viewed with the [[sealert]] utility, also provided in this package.
* setools-console provides the Tresys Technology SETools distribution, a number of utilities and libraries for analyzing and querying policy, audit log monitoring and reporting, and file context management. The setools package is a meta-package for SETools. The setools-gui package provides the [[apol]] and [[seaudit]] utilities. The setools-console package provides the [[sechecker]], [[sediff]], [[seinfo]], [[sesearch]], and [[findcon]] command-line utilities. Note that setools and setools-gui packages are available only when the Red&nbsp;Hat Network Optional channel is enabled. For further information, see Scope of Coverage Details.
* mcstrans translates levels, such as [[s0-s0:c0.c1023]], to a form that is easier to read, such as [[SystemLow-SystemHigh]].
* policycoreutils-python provides utilities such as [[semanage]], [[audit2allow]], [[audit2why]], and [[chcat]], for operating and managing SELinux.
* policycoreutils-gui provides [[system-config-selinux]], a graphical utility for managing SELinux.


=== 4.2. Which Log File is Used ===
; Beispiel
In Red&nbsp;Hat&nbsp;Enterprise&nbsp;Linux, the dbus and audit packages are installed by default, unless they are removed from the default package selection. The setroubleshoot-server must be installed using Yum (use the [[yum&nbsp;install&nbsp;setroubleshoot-server]] command).
: „Darf ein Webserver auf Dateien in den Home-Verzeichnissen der Benutzer zugreifen?“


If the [[auditd]] daemon is running, an SELinux denial message, such as the following, is written to [[/var/log/audit/audit.log]] by default:
; Umfassende und fein abgestufte Sicherheitsrichtlinien
Die standardmäßige Zugriffsrichtlinie, die auf Benutzer-, Gruppen- und anderen Berechtigungen basiert und als Discretionary Access Control (DAC) bekannt ist, ermöglicht es Systemadministratoren nicht, umfassende und fein abgestufte Sicherheitsrichtlinien zu erstellen, wie beispielsweise bestimmte Anwendungen darauf zu beschränken, Log-Dateien nur anzuzeigen, während anderen Anwendungen erlaubt wird, neue Daten an die Log-Dateien anzuhängen


type=AVC msg=audit(1223024155.684:49): avc: denied { getattr } for pid=2000 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=399185 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:samba_share_t:s0 tclass=file
; SELinux implementiert [[Mandatory Access Control]] (MAC)
* Jeder Prozess und jede Systemressource verfügt über eine spezielle Sicherheitskennzeichnung, die als „SELinux-Kontext“ bezeichnet wird
* Ein SELinux-Kontext, manchmal auch als „SELinux-Label“ bezeichnet, ist ein Identifikator, der die Details auf Systemebene abstrahiert und sich auf die Sicherheitseigenschaften der Entität konzentriert
* Dies bietet nicht nur eine konsistente Methode zur Referenzierung von Objekten in der SELinux-Richtlinie, sondern beseitigt auch jegliche Mehrdeutigkeit, die bei anderen Identifizierungsmethoden auftreten kann; beispielsweise kann eine Datei auf einem System, das Bind-Mounts verwendet, mehrere gültige Pfadnamen haben


In addition, a message similar to the one below is written to the [[/var/log/message]] file:
; Kontexte
Die SELinux-Richtlinie verwendet diese Kontexte in einer Reihe von Regeln, die definieren, wie Prozesse miteinander und mit den verschiedenen Systemressourcen interagieren können
* Standardmäßig erlaubt die Richtlinie keine Interaktion, es sei denn, eine Regel gewährt ausdrücklich Zugriff


May 7 18:55:56 localhost setroubleshoot: SELinux is preventing httpd (httpd_t) "getattr" to /var/www/html/file1 (samba_share_t). For complete SELinux messages. run sealert -l de7e30d6-5488-466d-a606-92c9f40d316d
; Hinweis
: Es ist wichtig zu beachten, dass SELinux-Richtlinienregeln nach den DAC-Regeln überprüft werden
:* SELinux-Richtlinienregeln werden nicht angewendet, wenn DAC-Regeln den Zugriff zuerst verweigern, was bedeutet, dass keine SELinux-Verweigerung protokolliert wird, wenn die herkömmlichen DAC-Regeln den Zugriff verhindern


In Red&nbsp;Hat&nbsp;Enterprise&nbsp;Linux 7, [[setroubleshootd]] no longer constantly runs as a service. However, it is still used to analyze the AVC messages. Two new programs act as a method to start [[setroubleshoot]] when needed: * The [[sedispatch]] utility runs as a part of the [[audit]] subsystem. When an AVC denial message is returned, [[sedispatch]] sends a message using [[dbus]]. These messages go straight to [[setroubleshootd]] if it is already running. If it is not running, [[sedispatch]] starts it automatically.
; Felder
* The [[seapplet]] utility runs in the system toolbar, waiting for dbus messages in [[setroubleshootd]]. It launches the notification bubble, allowing the user to review AVC messages.
SELinux-Kontexte bestehen aus mehreren Feldern
* Benutzer
* Rolle
* Typ
* Sicherheitsstufe


'''Procedure&nbsp;4.1.&nbsp;Starting Daemons Automatically'''# To configure the [[auditd]] and [[rsyslog]] daemons to automatically start at boot, enter the following commands as the root user: <br/>
; Typinformationen
<br/>
Die SELinux-Typinformationen sind für die SELinux-Richtlinie wohl am wichtigsten, da die gängigste Richtliniendevise, die die zulässigen Interaktionen zwischen Prozessen und Systemressourcen definiert, SELinux-Typen und nicht den vollständigen SELinux-Kontext verwendet
<br/> sudo  systemctl enable auditd.service<br/> sudo  systemctl enable rsyslog.service
* SELinux-Typen enden in der Regel mit _t
# To ensure that the daemons are enabled, type the following commands at the shell prompt:<br/>~]$ systemctl is-enabled auditd<br/>enabled<br/>~]$ systemctl is-enabled rsyslog<br/>enabled<br/>Alternatively, use the [[systemctl status ''service-name''.service]] command and search for the keyword [[enabled]] in the command output, for example: <br/>~]$ systemctl status auditd.service | grep enabled<br/>auditd.service - Security Auditing Service<br/> Loaded: loaded (/usr/lib/systemd/system/auditd.service; ''enabled'')
* Der Typname für den Webserver lautet beispielsweise httpd_t
* Der Typkontext für Dateien und Verzeichnisse, die normalerweise unter /var/www/html/ zu finden sind, ist httpd_sys_content_t
* Der Typkontext für Dateien und Verzeichnisse, die sich normalerweise in /tmp und /var/tmp/ befinden, lautet tmp_t
* Der Typkontext für Webserver-Ports lautet http_port_t


To learn more on how the [[systemd]] daemon manages system services, see the Managing System Services chapter in the System Administrator's Guide.
; Richtlinienregel
Es gibt etwa eine Richtlinienregel, die Apache (dem als httpd_t ausgeführten Webserver-Prozess) den Zugriff auf Dateien und Verzeichnisse mit einem Kontext erlaubt, der normalerweise in /var/www/html/ und anderen Webserver-Verzeichnissen (httpd_sys_content_t) zu finden ist
* Da die Richtlinie keine Zulassungsregel für Dateien enthält, die sich normalerweise in /tmp und /var/tmp/ befinden, ist der Zugriff nicht erlaubt
* Mit SELinux kann ein bösartiges Skript selbst dann nicht auf das Verzeichnis /tmp zugreifen, wenn Apache kompromittiert wurde und es Zugriff erlangt hat


=== 4.3. Main Configuration File ===
Abbildung 1.1
The [[/etc/selinux/config]] file is the main SELinux configuration file. It controls whether SELinux is enabled or disabled and which SELinux mode and SELinux policy is used:


# This file controls the state of SELinux on the system.
;HTTPD
# SELINUX= can take one of these three values:
* SELinux erlaubt dem als httpd_t laufenden Apache-Prozess den Zugriff auf das Verzeichnis /var/www/html/ und verweigert demselben Prozess den Zugriff auf das Verzeichnis /data/mysql/, da es keine Zulassungsregel für die Kontexte vom Typ httpd_t und mysqld_db_t gibt
#  enforcing - SELinux security policy is enforced.
* Andererseits kann der als mysqld_t ausgeführte MariaDB-Prozess auf das Verzeichnis /data/mysql/ zugreifen, und SELinux verweigert dem Prozess vom Typ mysqld_t korrekt den Zugriff auf das als httpd_sys_content_t gekennzeichnete Verzeichnis /var/www/html/.‚‘'
#  permissive - SELinux prints warnings instead of enforcing.
#  disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#  targeted - Targeted processes are protected,
#  mls - Multi Level Security protection.
SELINUXTYPE=targeted


<div style="margin-left:0cm;">[[SELINUX=]]</div>
== Vorteile ==
SELinux bietet die folgenden Vorteile
=== Labels ===
Alle Prozesse und Dateien sind mit Labels versehen


<div style="margin-left:1cm;">The [[SELINUX]] option sets whether SELinux is disabled or enabled and in which mode - enforcing or permissive - it is running: </div>* When using [[SELINUX=enforcing]], SELinux policy is enforced, and SELinux denies access based on SELinux policy rules. Denial messages are logged.
=== Richtlinienregeln ===
* When using [[SELINUX=permissive]], SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running SELinux in enforcing mode.
SELinux-Richtlinienregeln definieren, wie Prozesse mit Dateien interagieren sowie wie Prozesse miteinander interagieren
* When using [[SELINUX=disabled]], SELinux is disabled, the SELinux module is not registered with the Linux kernel, and only DAC rules are used.
* Zugriff ist nur dann erlaubt, wenn eine SELinux-Richtlinienregel existiert, die dies ausdrücklich erlaubt


<div style="margin-left:0cm;">[[SELINUXTYPE=]]</div>
=== Fein abgestimmte Zugriffskontrolle ===
* Über die traditionellen UNIX-Berechtigungen hinaus, die nach dem Ermessen des Benutzers gesteuert werden und auf Linux-Benutzer- und Gruppen-IDs basieren, basieren SELinux-Zugriffsentscheidungen auf allen verfügbaren Informationen, wie z.&nbsp;B.&nbsp;einem SELinux-Benutzer, einer Rolle, einem Typ und optional einer Sicherheitsstufe


<div style="margin-left:1cm;">The [[SELINUXTYPE]] option sets the SELinux policy to use. Targeted policy is the default policy. Only change this option if you want to use the MLS policy. For information on how to enable the MLS policy, see Section&nbsp;4.13.2, “Enabling MLS in SELinux”. </div>
* Die SELinux-Richtlinie wird administrativ definiert und systemweit durchgesetzt


=== 4.4. Permanent Changes in SELinux States and Modes ===
* Verbesserte Abwehr von Angriffen zur Privilegieneskalation
As discussed in Section&nbsp;1.4, “SELinux States and Modes”, SELinux can be enabled or disabled. When enabled, SELinux has two modes: enforcing and permissive.


Use the [[getenforce]] or [[sestatus]] commands to check in which mode SELinux is running. The [[getenforce]] command returns [[Enforcing]], [[Permissive]], or [[Disabled]].
* Prozesse laufen in Domänen und sind daher voneinander getrennt


The [[sestatus]] command returns the SELinux status and the SELinux policy being used:
* SELinux-Richtlinienregeln legen fest, wie Prozesse auf Dateien und andere Prozesse zugreifen


~]$ sestatus
* Wenn ein Prozess kompromittiert wird, hat der Angreifer nur Zugriff auf die normalen Funktionen dieses Prozesses und auf Dateien, für die der Prozess konfiguriert
SELinux status: enabled
wurde, darauf zuzugreifen
SELinuxfs mount: /sys/fs/selinux
* Wenn beispielsweise der Apache-HTTP-Server kompromittiert wird, kann ein Angreifer diesen Prozess nicht nutzen, um Dateien in Benutzer-Home-Verzeichnissen zu lesen, es sei denn, eine spezifische SELinux-Richtlinienregel wurde hinzugefügt oder so konfiguriert, dass sie einen solchen Zugriff erlaubt
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 30


'''Note'''
* SELinux kann eingesetzt werden, um die Vertraulichkeit und Integrität von Daten zu gewährleisten sowie Prozesse vor nicht vertrauenswürdigen Eingaben zu schützen


When systems run SELinux in permissive mode, users are able to label files incorrectly. Files created while SELinux is disabled are not labeled at all. This behavior causes problems when changing to enforcing mode because files are labeled incorrectly or are not labeled at all. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from the disabled state to permissive or enforcing mode.
; SELinux ist jedoch nicht
* Antivirensoftware
* ein Ersatz für Passwörter, Firewalls und andere Sicherheitssysteme
* eine All-in-One-Sicherheitslösung


==== 4.4.1. Enabling SELinux ====
SELinux wurde entwickelt, um bestehende Sicherheitslösungen zu ergänzen, nicht um sie zu ersetzen
When enabled, SELinux can run in one of two modes: enforcing or permissive. The following sections show how to permanently change into these modes.  
* Auch bei der Verwendung von SELinux ist es wichtig, weiterhin bewährte Sicherheitspraktiken zu befolgen, wie z.&nbsp;B.&nbsp;die Aktualisierung von Software, die Verwendung schwer zu erratender Passwörter oder den Einsatz von Firewalls


While enabling SELinux on systems that previously had it disabled, to avoid problems, such as systems unable to boot or process failures, Red Hat recommends to follow this procedure: # Enable SELinux in permissive mode. For more information, see Section&nbsp;4.4.1.1, “Permissive Mode”.
== Beispiele ==
# Reboot your system.
Die folgenden Beispiele veranschaulichen, wie SELinux die Sicherheit erhöht:
# Check for SELinux denial messages. For more information, see Section&nbsp;11.3.5, “Searching For and Viewing Denials”.
# If there are no denials, switch to enforcing mode. For more information, see Section&nbsp;4.4.1.2, “Enforcing Mode”.


To run custom applications with SELinux in enforcing mode, choose one of the following scenarios: * Run your application in the [[unconfined_service_t]] domain. See Section&nbsp;3.2, “Unconfined Processes” for more information.
; Standardaktion „verweigern“
* Write a new policy for your application. See the Writing Custom SELinux Policy Knowledgebase article for more information.
* Wenn keine SELinux-Richtlinienregel existiert, die den Zugriff erlaubt, beispielsweise für einen Prozess, der eine Datei öffnet, wird der Zugriff verweigert


===== 4.4.1.1. Permissive Mode =====
; Benutzer einschränken
When SELinux is running in permissive mode, SELinux policy is not enforced. The system remains operational and SELinux does not deny any operations but only logs AVC messages, which can be then used for troubleshooting, debugging, and SELinux policy improvements. Each AVC is logged only once in this case.  
* SELinux kann Linux-Benutzer einschränken
* In der SELinux-Richtlinie gibt es eine Reihe von eingeschränkten SELinux-Benutzern
* Linux-Benutzer können eingeschränkten SELinux-Benutzern zugeordnet werden, um die für diese geltenden Sicherheitsregeln und -mechanismen zu nutzen
* Wenn beispielsweise ein Linux-Benutzer dem SELinux-Benutzer ```user_u``` zugeordnet wird, führt dies dazu, dass dieser Linux-Benutzer (sofern nicht anders konfiguriert) keine Set-User-ID-Anwendungen (setuid) wie ```sudo``` und ```su``` ausführen kann
* Weitere Informationen finden Sie in Abschnitt 3.3, „Eingeschränkte und uneingeschränkte Benutzer“


To permanently change mode to permissive, follow the procedure below:
; Verbesserte Prozess- und Datentrennung
* Prozesse laufen in ihren eigenen Domänen, wodurch verhindert wird, dass Prozesse auf Dateien zugreifen, die von anderen Prozessen verwendet werden, und dass Prozesse auf andere Prozesse zugreifen
* Wenn beispielsweise SELinux ausgeführt wird, kann ein Angreifer – sofern nicht anders konfiguriert – keinen Samba-Server kompromittieren und diesen Samba-Server dann als Angriffsvektor nutzen, um auf Dateien zu lesen und zu schreiben, die von anderen Prozessen verwendet werden, wie z.&nbsp;B.&nbsp;MariaDB-Datenbanken


'''Procedure&nbsp;4.2.&nbsp;Changing to Permissive Mode'''# Edit the [[/etc/selinux/config]] file as follows: <br/>
; SELinux hilft dabei, den durch Konfigurationsfehler verursachten Schaden zu mindern
<br/><br/># This file controls the state of SELinux on the system.<br/># SELINUX= can take one of these three values:<br/>#  enforcing - SELinux security policy is enforced.<br/>#  permissive - SELinux prints warnings instead of enforcing.<br/>#  disabled - No SELinux policy is loaded.<br/>SELINUX='''permissive'''<br/># SELINUXTYPE= can take one of these two values:<br/>#  targeted - Targeted processes are protected,<br/>#  mls - Multi Level Security protection.<br/>SELINUXTYPE=targeted<br/>
* Domain Name System (DNS)-Server replizieren häufig Informationen untereinander in einem sogenannten Zonentransfer
<br/>
* Angreifer können Zonentransfers nutzen, um DNS-Server mit falschen Informationen zu aktualisieren
# Reboot the system: <br/>
* Wenn Berkeley Internet Name Domain (BIND) als DNS-Server unter Linux ausgeführt wird, verhindert die Standard-SELinux-Richtlinie – selbst wenn ein Administrator vergisst, einzuschränken, welche Server einen Zonentransfer durchführen dürfen –, dass Zonendateien [1] durch Zonentransfers, durch den BIND-Daemon named selbst oder durch andere Prozesse aktualisiert werden
<br/><br/> sudo  reboot<br/>
<br/>


===== 4.4.1.2. Enforcing Mode =====
; Hintergrundinformationen
When SELinux is running in enforcing mode, it enforces the SELinux policy and denies access based on SELinux policy rules. In Red&nbsp;Hat&nbsp;Enterprise&nbsp;Linux, enforcing mode is enabled by default when the system was initially installed with SELinux.
zu SELinux sowie Informationen zu verschiedenen Exploits, die SELinux verhindert hat, finden Sie im Artikel auf NetworkWorld.com: „A seatbelt for server software: SELinux blocks real-world exploits“[2]


If SELinux was disabled, follow the procedure below to change mode to enforcing again:
== Architektur ==
SELinux ist ein Linux Security Module (LSM), das in den Linux-Kernel integriert ist
* Das SELinux-Subsystem im Kernel wird von einer Sicherheitsrichtlinie gesteuert, die vom Administrator kontrolliert und beim Systemstart geladen wird
* Alle sicherheitsrelevanten Zugriffsvorgänge auf Kernel-Ebene im System werden von SELinux abgefangen und im Kontext der geladenen Sicherheitsrichtlinie geprüft
* Wenn die geladene Richtlinie den Vorgang zulässt, wird er fortgesetzt
* Andernfalls wird der Vorgang blockiert und der Prozess erhält eine Fehlermeldung


'''Procedure&nbsp;4.3.&nbsp;Changing to Enforcing Mode'''
SELinux-Entscheidungen, wie das Zulassen oder Verweigern von Zugriff, werden zwischengespeichert
* Dieser Cache wird als Access Vector Cache (AVC) bezeichnet
* Durch die Verwendung dieser zwischengespeicherten Entscheidungen müssen die SELinux-Richtlinienregeln weniger häufig überprüft werden, was die Leistung erhöht
* Beachten Sie, dass SELinux-Richtlinienregeln keine Wirkung haben, wenn DAC-Regeln den Zugriff zuvor verweigern


This procedure assumes that the selinux-policy-targeted, selinux-policy, libselinux, libselinux-python, libselinux-utils, policycoreutils, and policycoreutils-python packages are installed. To verify that the packages are installed, use the following command:
== Zustände und Modi ==
SELinux kann in einem von drei Modi ausgeführt werden: deaktiviert, permissiv oder durchgesetzt


rpm -q ''package_name''
Vom deaktivierten Modus wird dringend abgeraten; das System verzichtet nicht nur auf die Durchsetzung der SELinux-Richtlinie, sondern auch auf die Kennzeichnung persistenter Objekte wie Dateien, was eine spätere Aktivierung von SELinux erschwert


# Edit the [[/etc/selinux/config]] file as follows: <br/>
Im permissiven Modus verhält sich das System so, als würde SELinux die geladene Sicherheitsrichtlinie durchsetzen, einschließlich der Kennzeichnung von Objekten und der Ausgabe von Zugriffsverweigerungseinträgen in den Protokollen, doch werden tatsächlich keine Operationen verweigert
<br/><br/># This file controls the state of SELinux on the system.<br/># SELINUX= can take one of these three values:<br/>#  enforcing - SELinux security policy is enforced.<br/>#  permissive - SELinux prints warnings instead of enforcing.<br/>#  disabled - No SELinux policy is loaded.<br/>SELINUX='''enforcing'''<br/># SELINUXTYPE= can take one of these two values:<br/>#  targeted - Targeted processes are protected,<br/>#  mls - Multi Level Security protection.<br/>SELINUXTYPE=targeted<br/>
* Der permissive Modus wird zwar nicht für Produktionssysteme empfohlen, kann jedoch bei der Entwicklung von SELinux-Richtlinien hilfreich sein
<br/>
# Reboot the system: <br/>
<br/><br/> sudo  reboot<br/>
<br/><br/>On the next boot, SELinux relabels all the files and directories within the system and adds SELinux context for files and directories that were created when SELinux was disabled.


'''Note'''
Der Durchsetzungsmodus ist der standardmäßige und empfohlene Betriebsmodus; im Durchsetzungsmodus arbeitet SELinux normal und setzt die geladene Sicherheitsrichtlinie im gesamten System durch


After changing to enforcing mode, SELinux may deny some actions because of incorrect or missing SELinux policy rules. To view what actions SELinux denies, enter the following command as root:  
Verwenden Sie das Dienstprogramm setenforce, um zwischen dem Durchsetzungs- und dem permissiven Modus zu wechseln
* Mit setenforce vorgenommene Änderungen bleiben nach einem Neustart nicht erhalten
* Um in den Durchsetzungsmodus zu wechseln, geben Sie als Linux-Root-Benutzer den Befehl setenforce 1 ein
* Um in den permissiven Modus zu wechseln, geben Sie den Befehl setenforce 0 ein
* Verwenden Sie das Dienstprogramm getenforce, um den aktuellen SELinux-Modus anzuzeigen:
sudo  getenforce
Durchsetzungsmodus


  sudo  ausearch -m AVC,USER_AVC,SELINUX_ERR -ts today
  sudo  setenforce 0
sudo  getenforce
Erlaubter Modus


Alternatively, with the setroubleshoot-server package installed, enter the following command as root:
sudo  setenforce 1
sudo  getenforce
Durchsetzungsmodus
In Linux können Sie einzelne Domänen in den permissiven Modus versetzen, während das System im Enforcing-Modus läuft
* Um beispielsweise die Domäne httpd_t in den permissiven Modus zu versetzen:
sudo  semanage permissive -a httpd_t
Weitere Informationen finden Sie in Abschnitt 11.3.4, „Permissive Domänen“


sudo  grep "SELinux is preventing" /var/log/messages
; Hinweis
: Dauerhafte Änderungen an Zuständen und Modi werden in Abschnitt 4.4, „Dauerhafte Änderungen an SELinux-Zuständen und -Modi“, behandelt


If SELinux denies some actions, see Chapter&nbsp;11, ''Troubleshooting'' for information about troubleshooting.


Temporary changes in modes are covered in Section&nbsp;1.4, “SELinux States and Modes”.
<noinclude>


==== 4.4.2. Disabling SELinux ====
== Anhang ==
When SELinux is disabled, SELinux policy is not loaded at all; it is not enforced and AVC messages are not logged. Therefore, all benefits of running SELinux listed in Section&nbsp;1.1, “Benefits of running SELinux” are lost.
=== Siehe auch ===
<div style="column-count:2">
<categorytree hideroot=on mode="pages">{{BASEPAGENAME}}</categorytree>
</div>
----
{{Special:PrefixIndex/{{BASEPAGENAME}}/}}


'''Important'''
=== Dokumentation ===
<!--
; Man-Page
# [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)]


Red&nbsp;Hat strongly recommends to use permissive mode instead of permanently disabling SELinux. See Section&nbsp;4.4.1.1, “Permissive Mode” for more information about permissive mode.
; Info-Pages
-->


To permanently disable SELinux, follow the procedure below:  
=== Links ===
==== Projekt ====
==== Weblinks ====
# Red Hat Identity Management (IdM)
#* bietet eine zentralisierte Lösung zur Definition von SELinux-Benutzerzuordnungen
#* Weitere Informationen finden Sie unter „Defining SELinux User Maps“ im „Linux Domain Identity, Authentication, and Policy Guide“
# Marti, Don. „Ein Sicherheitsgurt für Server-Software: SELinux blockiert reale Exploits“
#* Veröffentlicht am 24.&nbsp;Februar 2008.&nbsp;Abgerufen am 27.&nbsp;August 2009: <nowiki>http://www.networkworld.com/article/2283723/lan-wan/a-seatbelt-for-server-software--selinux-blocks-real-world-exploits.html</nowiki>
# Die Manpage selinux(8) und die Manpages, die mit dem Befehl apropos selinux aufgelistet werden
# Man-Seiten, die mit dem Befehl man -k _selinux aufgelistet werden, wenn das Paket selinux-policy-doc installiert ist
# Das SELinux-Farbbuch
# SELinux-Wiki-FAQ


'''Procedure&nbsp;4.4.&nbsp;Disabling SELinux'''# Configure [[SELINUX=disabled]] in the [[/etc/selinux/config]] file: <br/>
<!--
<br/><br/># This file controls the state of SELinux on the system.<br/># SELINUX= can take one of these three values:<br/>#  enforcing - SELinux security policy is enforced.<br/>#  permissive - SELinux prints warnings instead of enforcing.<br/>#  disabled - No SELinux policy is loaded.<br/>SELINUX='''disabled'''<br/># SELINUXTYPE= can take one of these two values:<br/>#  targeted - Targeted processes are protected,<br/>#  mls - Multi Level Security protection.<br/>SELINUXTYPE=targeted<br/>
{{DEFAULTSORT:new}}
<br/>
{{DISPLAYTITLE:new}}
# Reboot your system. After reboot, confirm that the [[getenforce]] command returns [[Disabled]]: <br/>
-->
<br/><br/>~]$ getenforce<br/>Disabled<br/>
<br/>


=== 4.5. Changing SELinux Modes at Boot Time ===
[[Kategorie:new]]
On boot, you can set several kernel parameters to change the way SELinux runs:  


enforcing=0
</noinclude>
#


Setting this parameter causes the system to start in permissive mode, which is useful when troubleshooting issues. Using permissive mode might be the only option to detect a problem if your file system is too corrupted. Moreover, in permissive mode, the system continues to create the labels correctly. The AVC messages that are created in this mode can be different than in enforcing mode.
In permissive mode, only the first denial from a series of the same denials is reported. However, in enforcing mode, you might get a denial related to reading a directory, and an application stops. In permissive mode, you get the same AVC message, but the application continues reading files in the directory and you get an AVC for each denial in addition.
selinux=0
<div style="margin-left:1cm;">This parameter causes the kernel to not load any part of the SELinux infrastructure. The init scripts notice that the system booted with the [[selinux=0]] parameter and touch the [[/.autorelabel]] file. This causes the system to automatically relabel the next time you boot with SELinux enabled. </div>
<div style="margin-left:1cm;">'''Important'''</div>
<div style="margin-left:1cm;"></div>
<div style="margin-left:1cm;">Red Hat does not recommend using the [[selinux=0]] parameter. To debug your system, prefer using permissive mode. </div>
autorelabel=1
This parameter forces the system to relabel similarly to the following commands:
<div style="margin-left:1cm;"></div>
<div style="margin-left:1cm;"></div>
sudo  touch /.autorelabel
sudo  reboot
<div style="margin-left:1cm;"></div>
If the system labeling contains a large amount of errors, you might need to boot in permissive mode in order that the autorelabel succeeds.
For additional SELinux-related kernel boot parameters, such as [[checkreqprot]], see the [[/usr/share/doc/kernel-doc-''<KERNEL_VER>''/Documentation/kernel-parameters.txt]] file. This documentation is installed with the kernel-doc package. Replace the ''<KERNEL_VER>'' string with the version number of the installed kernel, for example:
sudo  yum install kernel-doc
~]$ less /usr/share/doc/kernel-doc-''3.10.0''/Documentation/kernel-parameters.txt
=== 4.6. Booleans ===
Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS volumes, without reloading or recompiling SELinux policy.
==== 4.6.1. Listing Booleans ====
For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the [[semanage boolean -l]] command as the Linux root user. The following example does not list all Booleans and the output is shortened for brevity:
sudo  semanage boolean -l
SELinux boolean State Default Description
smartmon_3ware (off , off) Determine whether smartmon can...
mpd_enable_homedirs (off , off) Determine whether mpd can traverse...
'''Note'''
To have more detailed descriptions, install the selinux-policy-devel package.
The [[SELinux boolean]] column lists Boolean names. The [[Description]] column lists whether the Booleans are on or off, and what they do.
The [[getsebool -a]] command lists Booleans, whether they are on or off, but does not give a description of each one. The following example does not list all Booleans:
~]$ getsebool -a
cvs_read_shadow --> off
daemons_dump_core --> on
Run the [[getsebool ''boolean-name'']] command to only list the status of the ''boolean-name'' Boolean:
~]$ getsebool cvs_read_shadow
cvs_read_shadow --> off
Use a space-separated list to list multiple Booleans:
~]$ getsebool cvs_read_shadow daemons_dump_core
cvs_read_shadow --> off
daemons_dump_core --> on
==== 4.6.2. Configuring Booleans ====
Run the [[setsebool]] utility in the [[setsebool ''boolean_name'' on/off]] form to enable or disable Booleans.
The following example demonstrates configuring the [[httpd_can_network_connect_db]] Boolean:
'''Procedure&nbsp;4.5.&nbsp;Configuring Booleans'''# By default, the [[httpd_can_network_connect_db]] Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers: <br/>
<br/><br/>~]$ getsebool httpd_can_network_connect_db<br/>httpd_can_network_connect_db --> off<br/>
<br/>
# To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, enter the following command as root: <br/>
<br/><br/> sudo  setsebool httpd_can_network_connect_db on<br/>
<br/>
# Use the [[getsebool]] utility to verify the Boolean has been enabled: <br/>
<br/><br/>~]$ getsebool httpd_can_network_connect_db<br/>httpd_can_network_connect_db --> on<br/>
<br/><br/>This allows Apache HTTP Server scripts and modules to connect to database servers.
# This change is not persistent across reboots. To make changes persistent across reboots, run the [[setsebool -P ''boolean-name'' on]] command as root:[3] <br/>
<br/><br/> sudo  setsebool -P httpd_can_network_connect_db on<br/>
<br/>
==== 4.6.3. Shell Auto-Completion ====
It is possible to use shell auto-completion with the [[getsebool]], [[setsebool]], and [[semanage]] utilities. Use the auto-completion with [[getsebool]] and [[setsebool]] to complete both command-line parameters and Booleans. To list only the command-line parameters, add the hyphen character ("-") after the command name and hit the [[Tab]] key:
sudo  setsebool -[Tab]
-P
To complete a Boolean, start writing the Boolean name and then hit [[Tab]]:
~]$ getsebool samba_[Tab]
samba_create_home_dirs samba_export_all_ro samba_run_unconfined
samba_domain_controller samba_export_all_rw samba_share_fusefs
samba_enable_home_dirs samba_portmapper samba_share_nfs
sudo  setsebool -P virt_use_[Tab]
virt_use_comm virt_use_nfs virt_use_sanlock
virt_use_execmem virt_use_rawip virt_use_usb
virt_use_fusefs virt_use_samba virt_use_xserver
The [[semanage]] utility is used with several command-line arguments that are completed one by one. The first argument of a [[semanage]] command is an option, which specifies what part of SELinux policy is managed:
sudo  semanage [Tab]
boolean export import login node port
dontaudit fcontext interface module permissive user
Then, one or more command-line parameters follow:
sudo  semanage fcontext -[Tab]
-a -D --equal --help -m -o
--add --delete -f -l --modify -S
-C --deleteall --ftype --list -n -t
-d -e -h --locallist --noheading --type
Finally, complete the name of a particular SELinux entry, such as a Boolean, SELinux user, domain, or another. Start typing the entry and hit [[Tab]]:
sudo  semanage fcontext -a -t samba<tab>
samba_etc_t samba_secrets_t
sambagui_exec_t samba_share_t
samba_initrc_exec_t samba_unconfined_script_exec_t
samba_log_t samba_unit_file_t
samba_net_exec_t
Command-line parameters can be chained in a command:
sudo  semanage port -a -t http_port_t -p tcp 81
=== 4.7. SELinux Contexts – Labeling Files ===
On systems running SELinux, all processes and files are labeled in a way that represents security-relevant information. This information is called the SELinux context. For files, this is viewed using the [[ls -Z]] command:
~]$ ls -Z file1
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
In this example, SELinux provides a user ([[unconfined_u]]), a role ([[object_r]]), a type ([[user_home_t]]), and a level ([[s0]]). This information is used to make access control decisions. On DAC systems, access is controlled based on Linux user and group IDs. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first.
'''Note'''
By default, newly-created files and directories inherit the SELinux type of their parent directories. For example, when creating a new file in the [[/etc]] directory that is labeled with the [[etc_t]] type, the new file inherits the same type:
~]$ ls -dZ - /etc
drwxr-xr-x. root root system_u:object_r:''etc_t'':s0 /etc
sudo  touch /etc/file1
sudo  ls -lZ /etc/file1
-rw-r--r--. root root unconfined_u:object_r:''etc_t'':s0 /etc/file1
SELinux provides multiple commands for managing the file system labeling, such as [[chcon]], [[semanage fcontext]], [[restorecon]], and [[matchpathcon]].
==== 4.7.1. Temporary Changes: chcon ====
The [[chcon]] command changes the SELinux context for files. However, changes made with the [[chcon]] command are not persistent across file-system relabels, or the execution of the [[restorecon]] command. SELinux policy controls whether users are able to modify the SELinux context for any given file. When using [[chcon]], users provide all or part of the SELinux context to change. An incorrect file type is a common cause of SELinux denying access.
==== Quick Reference ====
* Run the [[chcon -t ''type'' ''file-name'']] command to change the file type, where ''type'' is an SELinux type, such as [[httpd_sys_content_t]], and ''file-name'' is a file or directory name: <br/>
<br/><br/>~]$ chcon -t httpd_sys_content_t ''file-name''<br/>
<br/>
* Run the [[chcon -R -t ''type'' ''directory-name'']] command to change the type of the directory and its contents, where ''type'' is an SELinux type, such as [[httpd_sys_content_t]], and ''directory-name'' is a directory name: <br/>
<br/><br/>~]$ chcon -R -t httpd_sys_content_t ''directory-name''<br/>
<br/>
'''Procedure&nbsp;4.6.&nbsp;Changing a File's or Directory's Type'''
The following procedure demonstrates changing the type, and no other attributes of the SELinux context. The example in this section works the same for directories, for example, if [[file1]] was a directory. # Change into your home directory.
# Create a new file and view its SELinux context: <br/>
<br/><br/>~]$ touch file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z file1<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1<br/>
<br/><br/>In this example, the SELinux context for [[file1]] includes the SELinux [[unconfined_u]] user, [[object_r]] role, [[user_home_t]] type, and the [[s0]] level. For a description of each part of the SELinux context, see Chapter&nbsp;2, ''SELinux Contexts''.
# Enter the following command to change the type to [[samba_share_t]]. The [[-t]] option only changes the type. Then view the change: <br/>
<br/><br/>~]$ chcon -t samba_share_t file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z file1 <br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:samba_share_t:s0 file1<br/>
<br/>
# Use the following command to restore the SELinux context for the [[file1]] file. Use the [[-v]] option to view what changes: <br/>
<br/><br/>~]$ restorecon -v file1<br/>restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:user_home_t:s0<br/>
<br/><br/><br/><br/>In this example, the previous type, [[samba_share_t]], is restored to the correct, [[user_home_t]] type. When using targeted policy (the default SELinux policy in Red&nbsp;Hat&nbsp;Enterprise&nbsp;Linux), the [[restorecon]] command reads the files in the [[/etc/selinux/targeted/contexts/files/]] directory, to see which SELinux context files should have.
'''Procedure&nbsp;4.7.&nbsp;Changing a Directory and its Contents Types'''
The following example demonstrates creating a new directory, and changing the directory's file type along with its contents to a type used by the Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of [[/var/www/html/]]): # As the root user, create a new [[web/]] directory and then 3 empty files ([[file1]], [[file2]], and [[file3]]) within this directory. The [[web/]] directory and files in it are labeled with the [[default_t]] type: <br/>
<br/><br/> sudo  mkdir /web<br/>
<br/><br/><br/><br/><br/> sudo  touch /web/file{1,2,3}<br/>
<br/><br/><br/><br/><br/> sudo  ls -dZ /web<br/>drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web<br/>
<br/><br/><br/><br/><br/> sudo  ls -lZ /web<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3<br/>
<br/>
# As root, enter the following command to change the type of the [[web/]] directory (and its contents) to [[httpd_sys_content_t]]: <br/>
<br/><br/> sudo  chcon -R -t httpd_sys_content_t /web/<br/>
<br/><br/><br/><br/><br/> sudo  ls -dZ /web/<br/>drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 /web/<br/>
<br/><br/><br/><br/><br/> sudo  ls -lZ /web/<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3<br/>
<br/>
# To restore the default SELinux contexts, use the [[restorecon]] utility as root: <br/>
<br/><br/> sudo  restorecon -R -v /web/<br/>restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0<br/>restorecon reset /web/file2 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0<br/>restorecon reset /web/file3 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0<br/>restorecon reset /web/file1 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0<br/>
<br/><br/><br/>
See the chcon(1) manual page for further information about [[chcon]].
'''Note'''
Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored.
==== 4.7.2. Persistent Changes: semanage fcontext ====
The [[semanage fcontext]] command is used to change the SELinux context of files. To show contexts to newly created files and directories, enter the following command as root:
sudo  semanage fcontext -C -l
Changes made by [[semanage fcontext]] are used by the following utilities. The [[setfiles]] utility is used when a file system is relabeled and the [[restorecon]] utility restores the default SELinux contexts. This means that changes made by [[semanage fcontext]] are persistent, even if the file system is relabeled. SELinux policy controls whether users are able to modify the SELinux context for any given file.
==== Quick Reference ====
To make SELinux context changes that survive a file system relabel: # Enter the following command, remembering to use the full path to the file or directory: <br/>
<br/><br/> sudo  semanage fcontext -a ''options'' ''file-name''|''directory-name''<br/>
<br/>
# Use the [[restorecon]] utility to apply the context changes: <br/>
<br/><br/> sudo  restorecon -v ''file-name''|''directory-name''<br/>
<br/>
===== Use of regular expressions with semanage fcontext =====
For the [[semanage fcontext]] command to work correctly, you can use either a fully qualified path or '''Perl-compatible regular expressions ()'''. The only ''PCRE'' flag in use is [[PCRE2_DOTALL]], which causes the [[.]] wildcard to match anything, including a new line. Strings representing paths are processed as bytes, meaning that non-ASCII characters are not matched by a single wildcard.
Note that file-context definitions specified using [[semanage fcontext]] are evaluated in reverse order to how they were defined: the latest entry is evaluated first regardless of the stem length. Local file context modifications stored in [[file_contexts.local]] have a higher priority than those specified in policy modules. This means that whenever a match for a given file path is found in [[file_contexts.local]], no other file-context definitions are considered.
'''Important'''
File-context definitions specified using the [[semanage fcontext]] command effectively override all other file-context definitions. All regular expressions should therefore be as specific as possible to avoid unintentionally impacting other parts of the file system.
For more information on a type of regular expression used in file-context definitions and flags in effect, see the [[semanage-fcontext(8)]] man page.
'''Procedure&nbsp;4.8.&nbsp;Changing a File's or Directory 's Type'''
The following example demonstrates changing a file's type, and no other attributes of the SELinux context. This example works the same for directories, for instance if [[file1]] was a directory. # As the root user, create a new file in the [[/etc]] directory. By default, newly-created files in [[/etc]] are labeled with the [[etc_t]] type: <br/>
<br/><br/> sudo  touch /etc/file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z /etc/file1<br/>-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1<br/>
<br/><br/>To list information about a directory, use the following command: <br/>
<br/><br/>~]$ ls -dZ ''directory_name''<br/>
<br/>
# As root, enter the following command to change the [[file1]] type to [[samba_share_t]]. The [[-a]] option adds a new record, and the [[-t]] option defines a type ([[samba_share_t]]). Note that running this command does not directly change the type; [[file1]] is still labeled with the [[etc_t]] type: <br/>
<br/><br/> sudo  semanage fcontext -a -t samba_share_t /etc/file1<br/>
<br/><br/><br/><br/><br/> sudo  ls -Z /etc/file1<br/>-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1<br/>
<br/><br/><br/><br/><br/>~]$ semanage fcontext -C -l<br/>/etc/file1 unconfined_u:object_r:samba_share_t:s0<br/>
<br/>
# As root, use the [[restorecon]] utility to change the type. Because [[semanage]] added an entry to [[file_contexts.local]] for [[/etc/file1]], [[restorecon]] changes the type to [[samba_share_t]]: <br/>
<br/><br/> sudo  restorecon -v /etc/file1<br/>restorecon reset /etc/file1 context unconfined_u:object_r:etc_t:s0->system_u:object_r:samba_share_t:s0<br/>
<br/><br/><br/>
'''Procedure&nbsp;4.9.&nbsp;Changing a Directory and its Contents Types'''
The following example demonstrates creating a new directory, and changing the directory's file type along with its contents to a type used by Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root instead of [[/var/www/html/]]: # As the root user, create a new [[web/]] directory and then 3 empty files ([[file1]], [[file2]], and [[file3]]) within this directory. The [[web/]] directory and files in it are labeled with the [[default_t]] type: <br/>
<br/><br/> sudo  mkdir /web<br/>
<br/><br/><br/><br/><br/> sudo  touch /web/file{1,2,3}<br/>
<br/><br/><br/><br/><br/> sudo  ls -dZ /web<br/>drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web<br/>
<br/><br/><br/><br/><br/> sudo  ls -lZ /web<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3<br/>
<br/>
# As root, enter the following command to change the type of the [[web/]] directory and the files in it, to [[httpd_sys_content_t]]. The [[-a]] option adds a new record, and the [[-t]] option defines a type ([[httpd_sys_content_t]]). The [["/web(/.*)?"]] regular expression causes [[semanage]] to apply changes to [[web/]], as well as the files in it. Note that running this command does not directly change the type; [[web/]] and files in it are still labeled with the [[default_t]] type: <br/>
<br/><br/> sudo  semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"<br/>
<br/><br/><br/><br/><br/>~]$ ls -dZ /web<br/>drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web<br/>
<br/><br/><br/><br/><br/>~]$ ls -lZ /web<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3<br/>
<br/><br/>The [[semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"]] command adds the following entry to [[/etc/selinux/targeted/contexts/files/file_contexts.local]]: <br/>
<br/><br/>/web(/.*)? system_u:object_r:httpd_sys_content_t:s0<br/>
<br/>
# As root, use the [[restorecon]] utility to change the type of [[web/]], as well as all files in it. The [[-R]] is for recursive, which means all files and directories under [[web/]] are labeled with the [[httpd_sys_content_t]] type. Since [[semanage]] added an entry to [[file.contexts.local]] for [[/web(/.*)?]], [[restorecon]] changes the types to [[httpd_sys_content_t]]: <br/>
<br/><br/> sudo  restorecon -R -v /web<br/>restorecon reset /web context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0<br/>restorecon reset /web/file2 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0<br/>restorecon reset /web/file3 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0<br/>restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0<br/>
<br/><br/><br/><br/>Note that by default, newly-created files and directories inherit the SELinux type of their parent directories.
'''Procedure&nbsp;4.10.&nbsp;Deleting an added Context'''
The following example demonstrates adding and removing an SELinux context. If the context is part of a regular expression, for example, [[/web(/.*)?]], use quotation marks around the regular expression:
sudo  semanage fcontext -d "/web(/.*)?"
# To remove the context, as root, enter the following command, where ''file-name''|''directory-name'' is the first part in [[file_contexts.local]]: <br/>
<br/><br/> sudo  semanage fcontext -d ''file-name''|''directory-name''<br/>
<br/><br/>The following is an example of a context in [[file_contexts.local]]: <br/>
<br/><br/>/test system_u:object_r:httpd_sys_content_t:s0<br/>
<br/><br/>With the first part being [[test]]. To prevent the [[test/]] directory from being labeled with the [[httpd_sys_content_t]] after running [[restorecon]], or after a file system relabel, enter the following command as root to delete the context from [[file_contexts.local]]: <br/>
<br/><br/> sudo  semanage fcontext -d /test<br/>
<br/>
# As root, use the [[restorecon]] utility to restore the default SELinux context.
For further information about [[semanage]], see the semanage(8) and semanage-fcontext(8) manual pages.
'''Important'''
When changing the SELinux context with [[semanage fcontext -a]], use the full path to the file or directory to avoid files being mislabeled after a file system relabel, or after the [[restorecon]] command is run.
==== 4.7.3. How File Context is Determined ====
Determining file context is based on file-context definitions, which are specified in the system security policy (the [[.fc]] files). Based on the system policy, [[semanage]] generates [[file_contexts.homedirs]] and [[file_contexts]] files.
System administrators can customize file-context definitions using the [[semanage fcontext]] command. Such customizations are stored in the [[file_contexts.local]] file.
When a labeling utility, such as [[matchpathcon]] or [[restorecon]], is determining the proper label for a given path, it searches for local changes first ([[file_contexts.local]]). If the utility does not find a matching pattern, it searches the [[file_contexts.homedirs]] file and finally the [[file_contexts]] file. However, whenever a match for a given file path is found, the search ends, the utility does look for any additional file-context definitions. This means that home directory-related file contexts have higher priority than the rest, and local customizations override the system policy.
File-context definitions specified by [[system policy]] (contents of [[file_contexts.homedirs]] and [[file_contexts]] files) are sorted by the length of the stem (prefix of the path before any wildcard) before evaluation. This means that the most specific path is chosen. However, file-context definitions specified using [[semanage fcontext]] are evaluated in reverse order to how they were defined: the latest entry is evaluated first regardless of the stem length.
For more information on: * changing the context of a file by using [[chcon]], see Section&nbsp;4.7.1, “Temporary Changes: chcon”.
* changing and adding a file-context definition by using [[semanage fcontext]], see Section&nbsp;4.7.2, “Persistent Changes: semanage fcontext”.
* changing and adding a file-context definition through a system-policy operation, see Section&nbsp;4.10, “Maintaining SELinux Labels” or Section&nbsp;4.12, “Prioritizing and Disabling SELinux Policy Modules”.
=== 4.8. The file_t and default_t Types ===
When using a file system that supports extended attributes (EA), the [[file_t]] type is the default type of a file that has not yet been assigned EA value. This type is only used for this purpose and does not exist on correctly-labeled file systems, because all files on a system running SELinux should have a proper SELinux context, and the [[file_t]] type is never used in file-context configuration[4].
The [[default_t]] type is used on files that do not match any pattern in file-context configuration, so that such files can be distinguished from files that do not have a context on disk, and generally are kept inaccessible to confined domains. For example, if you create a new top-level directory, such as [[mydirectory/]], this directory may be labeled with the default_t type. If services need access to this directory, you need to update the file-contexts configuration for this location. See Section&nbsp;4.7.2, “Persistent Changes: semanage fcontext” for details on adding a context to the file-context configuration.
=== 4.9. Mounting File Systems ===
By default, when a file system that supports extended attributes is mounted, the security context for each file is obtained from the ''security.selinux'' extended attribute of the file. Files in file systems that do not support extended attributes are assigned a single, default security context from the policy configuration, based on file system type.
Use the [[mount -o context]] command to override existing extended attributes, or to specify a different, default context for file systems that do not support extended attributes. This is useful if you do not trust a file system to supply the correct attributes, for example, removable media used in multiple systems. The [[mount -o context]] command can also be used to support labeling for file systems that do not support extended attributes, such as File Allocation Table (FAT) or NFS volumes. The context specified with the [[context]] option is not written to disk: the original contexts are preserved, and are seen when mounting without [[context]] if the file system had extended attributes in the first place.
For further information about file system labeling, see James Morris's "Filesystem Labeling in SELinux" article: http://www.linuxjournal.com/article/7426.
==== 4.9.1. Context Mounts ====
To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the root user, use the [[mount -o context=''SELinux_user:role:type:level'']] command when mounting the required file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the [[nfs_t]] type. Without additional mount options, this may prevent sharing NFS volumes using other services, such as the Apache HTTP Server. The following example mounts an NFS volume so that it can be shared using the Apache HTTP Server:
sudo  mount server:/export /local/mount/point -o \ context="system_u:object_r:httpd_sys_content_t:s0"
Newly-created files and directories on this file system appear to have the SELinux context specified with [[-o context]]. However, since these changes are not written to disk, the context specified with this option does not persist between mounts. Therefore, this option must be used with the same context specified during every mount to retain the required context. For information about making context mount persistent, see Section&nbsp;4.9.5, “Making Context Mounts Persistent”.
Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with [[-o context]], use the SELinux [[system_u]] user and [[object_r]] role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the [[s0]] level.
'''Note'''
When a file system is mounted with a [[context]] option, context changes by users and processes are prohibited. For example, running the [[chcon]] command on a file system mounted with a [[context]] option results in a [[Operation not supported]] error.
==== 4.9.2. Changing the Default Context ====
As mentioned in Section&nbsp;4.8, “The file_t and default_t Types”, on file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the [[file_t]] type. If it is desirable to use a different default context, mount the file system with the [[defcontext]] option.
The following example mounts a newly-created file system on [[/dev/sda2]] to the newly-created [[test/]] directory. It assumes that there are no rules in [[/etc/selinux/targeted/contexts/files/]] that define a context for the [[test/]] directory:
sudo  mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:s0"
In this example: * the [[defcontext]] option defines that [[system_u:object_r:samba_share_t:s0]] is "the default security context for unlabeled files"[5].
* when mounted, the root directory ([[test/]]) of the file system is treated as if it is labeled with the context specified by [[defcontext]] (this label is not stored on disk). This affects the labeling for files created under [[test/]]: new files inherit the [[samba_share_t]] type, and these labels are stored on disk.
* files created under [[test/]] while the file system was mounted with a [[defcontext]] option retain their labels.
==== 4.9.3. Mounting an NFS Volume ====
By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the [[nfs_t]] type. Depending on policy configuration, services, such as Apache HTTP Server and MariaDB, may not be able to read files labeled with the [[nfs_t]] type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services.
If you would like to mount an NFS volume and read or export that file system with another service, use the [[context]] option when mounting to override the [[nfs_t]] type. Use the following context option to mount NFS volumes so that they can be shared using the Apache HTTP Server:
sudo  mount server:/export /local/mount/point -o context="system_u:object_r:httpd_sys_content_t:s0"
Since these changes are not written to disk, the context specified with this option does not persist between mounts. Therefore, this option must be used with the same context specified during every mount to retain the required context. For information about making context mount persistent, see Section&nbsp;4.9.5, “Making Context Mounts Persistent”.
As an alternative to mounting file systems with [[context]] options, Booleans can be enabled to allow services access to file systems labeled with the [[nfs_t]] type. See Part&nbsp;II, “Managing Confined Services” for instructions on configuring Booleans to allow services access to the [[nfs_t]] type.
==== 4.9.4. Multiple NFS Mounts ====
When mounting multiple mounts from the same NFS export, attempting to override the SELinux context of each mount with a different context, results in subsequent mount commands failing. In the following example, the NFS server has a single export, [[export/]], which has two subdirectories, [[web/]] and [[database/]]. The following commands attempt two mounts from a single NFS export, and try to override the context for each one:
sudo  mount server:/export/web /local/web -o context="system_u:object_r:httpd_sys_content_t:s0"
sudo  mount server:/export/database /local/database -o context="system_u:object_r:mysqld_db_t:s0"
The second mount command fails, and the following is logged to [[/var/log/messages]]:
kernel: SELinux: mount invalid. Same superblock, different security settings for (dev 0:15, type nfs)
To mount multiple mounts from a single NFS export, with each mount having a different context, use the [[-o nosharecache,context]] options. The following example mounts multiple mounts from a single NFS export, with a different context for each mount (allowing a single service access to each one):
sudo  mount server:/export/web /local/web -o nosharecache,context="system_u:object_r:httpd_sys_content_t:s0"
sudo  mount server:/export/database /local/database -o \ nosharecache,context="system_u:object_r:mysqld_db_t:s0"
In this example, [[server:/export/web]] is mounted locally to the [[/local/web/]] directory, with all files being labeled with the [[httpd_sys_content_t]] type, allowing Apache HTTP Server access. [[server:/export/database]] is mounted locally to [[/local/database/]], with all files being labeled with the [[mysqld_db_t]] type, allowing MariaDB access. These type changes are not written to disk.
'''Important'''
The [[nosharecache]] options allows you to mount the same subdirectory of an export multiple times with different contexts, for example, mounting [[/export/web/]] multiple times. Do not mount the same subdirectory from an export multiple times with different contexts, as this creates an overlapping mount, where files are accessible under two different contexts.
==== 4.9.5. Making Context Mounts Persistent ====
To make context mounts persistent across remounting and reboots, add entries for the file systems in the [[/etc/fstab]] file or an automounter map, and use the required context as a mount option. The following example adds an entry to [[/etc/fstab]] for an NFS context mount:
server:/export /local/mount/ nfs context="system_u:object_r:httpd_sys_content_t:s0" 0 0
=== 4.10. Maintaining SELinux Labels ===
These sections describe what happens to SELinux contexts when copying, moving, and archiving files and directories. Also, it explains how to preserve contexts when copying and archiving.
==== 4.10.1. Copying Files and Directories ====
When a file or directory is copied, a new file or directory is created if it does not exist. That new file or directory's context is based on default-labeling rules, not the original file or directory's context unless options were used to preserve the original context. For example, files created in user home directories are labeled with the [[user_home_t]] type:
~]$ touch file1
~]$ ls -Z file1
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
If such a file is copied to another directory, such as [[/etc]], the new file is created in accordance to default-labeling rules for [[/etc]]. Copying a file without additional options may not preserve the original context:
~]$ ls -Z file1
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
sudo  cp file1 /etc/
~]$ ls -Z /etc/file1
-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1
When [[file1]] is copied to [[/etc]], if [[/etc/file1]] does not exist, [[/etc/file1]] is created as a new file. As shown in the example above, [[/etc/file1]] is labeled with the [[etc_t]] type, in accordance to default-labeling rules.
When a file is copied over an existing file, the existing file's context is preserved, unless the user specified [[cp]] options to preserve the context of the original file, such as [[--preserve=context]]. SELinux policy may prevent contexts from being preserved during copies.
'''Procedure&nbsp;4.11.&nbsp;Copying Without Preserving SELinux Contexts'''
This procedure shows that when copying a file with the [[cp]] command, if no options are given, the type is inherited from the targeted, parent directory. # Create a file in a user's home directory. The file is labeled with the [[user_home_t]] type: <br/>
<br/><br/>~]$ touch file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z file1<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1<br/>
<br/>
# The [[/var/www/html/]] directory is labeled with the [[httpd_sys_content_t]] type, as shown with the following command: <br/>
<br/><br/>~]$ ls -dZ /var/www/html/<br/>drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/<br/>
<br/>
# When [[file1]] is copied to [[/var/www/html/]], it inherits the [[httpd_sys_content_t]] type: <br/>
<br/><br/> sudo  cp file1 /var/www/html/<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z /var/www/html/file1<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/file1<br/>
<br/><br/><br/>
'''Procedure&nbsp;4.12.&nbsp;Preserving SELinux Contexts When Copying'''
This procedure shows how to use the [[--preserve=context]] option to preserve contexts when copying. # Create a file in a user's home directory. The file is labeled with the [[user_home_t]] type: <br/>
<br/><br/>~]$ touch file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z file1<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1<br/>
<br/>
# The [[/var/www/html/]] directory is labeled with the [[httpd_sys_content_t]] type, as shown with the following command: <br/>
<br/><br/>~]$ ls -dZ /var/www/html/<br/>drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/<br/>
<br/>
# Using the [[--preserve=context]] option preserves SELinux contexts during copy operations. As shown below, the [[user_home_t]] type of [[file1]] was preserved when the file was copied to [[/var/www/html/]]: <br/>
<br/><br/> sudo  cp --preserve=context file1 /var/www/html/<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z /var/www/html/file1<br/>-rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/file1<br/>
<br/><br/><br/>
'''Procedure&nbsp;4.13.&nbsp;Copying and Changing the Context'''
This procedure show how to use the [[--context]] option to change the destination copy's context. The following example is performed in the user's home directory: # Create a file in a user's home directory. The file is labeled with the [[user_home_t]] type: <br/>
<br/><br/>~]$ touch file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z file1<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1<br/>
<br/>
# Use the [[--context]] option to define the SELinux context: <br/>
<br/><br/>~]$ cp --context=system_u:object_r:samba_share_t:s0 file1 file2<br/>
<br/>
# Without [[--context]], [[file2]] would be labeled with the [[unconfined_u:object_r:user_home_t]] context: <br/>
<br/><br/>~]$ ls -Z file1 file2<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1<br/>-rw-rw-r-- user1 group1 system_u:object_r:samba_share_t:s0 file2<br/>
<br/>
'''Procedure&nbsp;4.14.&nbsp;Copying a File Over an Existing File'''
This procedure shows that when a file is copied over an existing file, the existing file's context is preserved unless an option is used to preserve contexts. # As root, create a new file, [[file1]] in the [[/etc]] directory. As shown below, the file is labeled with the [[etc_t]] type: <br/>
<br/><br/> sudo  touch /etc/file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z /etc/file1<br/>-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1<br/>
<br/>
# Create another file, [[file2]], in the [[/tmp]] directory. As shown below, the file is labeled with the [[user_tmp_t]] type: <br/>
<br/><br/>~]$ touch /tmp/file2<br/>
<br/><br/><br/><br/><br/>~$ ls -Z /tmp/file2<br/>-rw-r--r-- root root unconfined_u:object_r:user_tmp_t:s0 /tmp/file2<br/>
<br/>
# Overwrite [[file1]] with [[file2]]: <br/>
<br/><br/> sudo  cp /tmp/file2 /etc/file1<br/>
<br/>
# After copying, the following command shows [[file1]] labeled with the [[etc_t]] type, not the [[user_tmp_t]] type from [[/tmp/file2]] that replaced [[/etc/file1]]: <br/>
<br/><br/>~]$ ls -Z /etc/file1<br/>-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1<br/>
<br/>
'''Important'''
Copy files and directories, rather than moving them. This helps ensure they are labeled with the correct SELinux contexts. Incorrect SELinux contexts can prevent processes from accessing such files and directories.
==== 4.10.2. Moving Files and Directories ====
Files and directories keep their current SELinux context when they are moved. In many cases, this is incorrect for the location they are being moved to. The following example demonstrates moving a file from a user's home directory to the [[/var/www/html/]] directory, which is used by the Apache HTTP Server. Since the file is moved, it does not inherit the correct SELinux context:
'''Procedure&nbsp;4.15.&nbsp;Moving Files and Directories'''# Change into your home directory and create file in it. The file is labeled with the [[user_home_t]] type: <br/>
<br/><br/>~]$ touch file1<br/>
<br/><br/><br/><br/><br/>~]$ ls -Z file1<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1<br/>
<br/>
# Enter the following command to view the SELinux context of the [[/var/www/html/]] directory: <br/>
<br/><br/>~]$ ls -dZ /var/www/html/<br/>drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/<br/>
<br/><br/>By default, [[/var/www/html/]] is labeled with the [[httpd_sys_content_t]] type. Files and directories created under [[/var/www/html/]] inherit this type, and as such, they are labeled with this type.
# As root, move [[file1]] to [[/var/www/html/]]. Since this file is moved, it keeps its current [[user_home_t]] type: <br/>
<br/><br/> sudo  mv file1 /var/www/html/<br/>
<br/><br/><br/><br/><br/> sudo  ls -Z /var/www/html/file1<br/>-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 /var/www/html/file1<br/>
<br/><br/><br/>
By default, the Apache HTTP Server cannot read files that are labeled with the [[user_home_t]] type. If all files comprising a web page are labeled with the [[user_home_t]] type, or another type that the Apache HTTP Server cannot read, permission is denied when attempting to access them using web browsers, such as '''Mozilla Firefox'''.
'''Important'''
Moving files and directories with the [[mv]] command may result in the incorrect SELinux context, preventing processes, such as the Apache HTTP Server and Samba, from accessing such files and directories.
==== 4.10.3. Checking the Default SELinux Context ====
Use the [[matchpathcon]] utility to check if files and directories have the correct SELinux context. This utility queries the [[system policy]] and then provides the default security context associated with the file path.[6] The following example demonstrates using [[matchpathcon]] to verify that files in [[/var/www/html/]] directory are labeled correctly:
'''Procedure&nbsp;4.16.&nbsp;Checking the Default SELinux Conxtext with [[matchpathcon''']]# As the root user, create three files ([[file1]], [[file2]], and [[file3]]) in the [[/var/www/html/]] directory. These files inherit the [[httpd_sys_content_t]] type from [[/var/www/html/]]: <br/>
<br/><br/> sudo  touch /var/www/html/file{1,2,3}<br/>
<br/><br/><br/><br/><br/> sudo  ls -Z /var/www/html/<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3<br/>
<br/>
# As root, change the [[file1]] type to [[samba_share_t]]. Note that the Apache HTTP Server cannot read files or directories labeled with the [[samba_share_t]] type. <br/>
<br/><br/> sudo  chcon -t samba_share_t /var/www/html/file1<br/>
<br/>
# The [[matchpathcon]] [[-V]] option compares the current SELinux context to the correct, default context in SELinux policy. Enter the following command to check all files in the [[/var/www/html/]] directory: <br/>
<br/><br/>~]$ matchpathcon -V /var/www/html/*<br/>/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0<br/>/var/www/html/file2 verified.<br/>/var/www/html/file3 verified.<br/>
<br/><br/><br/>
The following output from the [[matchpathcon]] command explains that [[file1]] is labeled with the [[samba_share_t]] type, but should be labeled with the [[httpd_sys_content_t]] type:
/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0
To resolve the label problem and allow the Apache HTTP Server access to [[file1]], as root, use the [[restorecon]] utility:
sudo  restorecon -v /var/www/html/file1
restorecon reset /var/www/html/file1 context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0
==== 4.10.4. Archiving Files with tar ====
The [[tar]] utility does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use the [[tar --selinux]] command to create archives that retain contexts and to restore files from the archives. If a [[tar]] archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, use the [[restorecon]] utility:
~]$ tar -xvf ''archive.tar'' | restorecon -f -
Note that depending on the directory, you may need to be the root user to run the [[restorecon]].
The following example demonstrates creating a [[tar]] archive that retains SELinux contexts:
'''Procedure&nbsp;4.17.&nbsp;Creating a tar Archive'''# Change to the [[/var/www/html/]] directory and view its SELinux context: <br/>
<br/><br/>~]$ cd /var/www/html/<br/>
<br/><br/><br/><br/><br/>html]$ ls -dZ /var/www/html/<br/>drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 .<br/>
<br/>
# As root, create three files ([[file1]], [[file2]], and [[file3]]) in [[/var/www/html/]]. These files inherit the [[httpd_sys_content_t]] type from [[/var/www/html/]]: <br/>
<br/><br/>html]# touch file{1,2,3}<br/>
<br/><br/><br/><br/><br/>html]$ ls -Z /var/www/html/<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3<br/>
<br/>
# As root, enter the following command to create a [[tar]] archive named [[test.tar]]. Use the [[--selinux]] to retain the SELinux context: <br/>
<br/><br/>html]# tar --selinux -cf test.tar file{1,2,3}<br/>
<br/>
# As root, create a new directory named [[test/]], and then allow all users full access to it: <br/>
<br/><br/> sudo  mkdir /test<br/>
<br/><br/><br/><br/><br/> sudo  chmod 777 /test/<br/>
<br/>
# Copy the [[test.tar]] file into [[test/]]: <br/>
<br/><br/>~]$ cp /var/www/html/test.tar /test/<br/>
<br/>
# Change into [[test/]] directory. Once in this directory, enter the following command to extract the [[tar]] archive. Specify the [[--selinux]] option again otherwise the SELinux context will be changed to [[default_t]]: <br/>
<br/><br/>~]$ cd /test/<br/>
<br/><br/><br/><br/><br/>test]$ tar --selinux -xvf test.tar<br/>
<br/>
# View the SELinux contexts. The [[httpd_sys_content_t]] type has been retained, rather than being changed to [[default_t]], which would have happened had the [[--selinux]] not been used: <br/>
<br/><br/>test]$ ls -lZ /test/<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.tar<br/>
<br/>
# If the [[test/]] directory is no longer required, as root, enter the following command to remove it, as well as all files in it: <br/>
<br/><br/> sudo  rm -ri /test/<br/>
<br/>
See the tar(1) manual page for further information about [[tar]], such as the [[--xattrs]] option that retains all extended attributes.
==== 4.10.5. Archiving Files with star ====
The [[star]] utility does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use the [[star -xattr -H=exustar]] command to create archives that retain contexts. The star package is not installed by default. To install [[star]], run the [[yum install star]] command as the root user.
The following example demonstrates creating a [[star]] archive that retains SELinux contexts:
'''Procedure&nbsp;4.18.&nbsp;Creating a [[star]] Archive'''# As root, create three files ([[file1]], [[file2]], and [[file3]]) in the [[/var/www/html/]]. These files inherit the [[httpd_sys_content_t]] type from [[/var/www/html/]]: <br/>
<br/><br/> sudo  touch /var/www/html/file{1,2,3}<br/>
<br/><br/><br/><br/><br/> sudo  ls -Z /var/www/html/<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2<br/>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3<br/>
<br/>
# Change into [[/var/www/html/]] directory. Once in this directory, as root, enter the following command to create a [[star]] archive named [[test.star]]: <br/>
<br/><br/>~]$ cd /var/www/html<br/>
<br/><br/><br/><br/><br/>html]# star -xattr -H=exustar -c -f=test.star file{1,2,3}<br/>star: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).<br/>
<br/>
# As root, create a new directory named [[test/]], and then allow all users full access to it: <br/>
<br/><br/> sudo  mkdir /test<br/>
<br/><br/><br/><br/><br/> sudo  chmod 777 /test/<br/>
<br/>
# Enter the following command to copy the [[test.star]] file into [[test/]]: <br/>
<br/><br/>~]$ cp /var/www/html/test.star /test/<br/>
<br/>
# Change into [[test/]]. Once in this directory, enter the following command to extract the [[star]] archive: <br/>
<br/><br/>~]$ cd /test/<br/>
<br/><br/><br/><br/><br/>test]$ star -x -f=test.star <br/>star: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).<br/>
<br/>
# View the SELinux contexts. The [[httpd_sys_content_t]] type has been retained, rather than being changed to [[default_t]], which would have happened had the [[-xattr -H=exustar]] option not been used: <br/>
<br/><br/>~]$ ls -lZ /test/<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3<br/>-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.star<br/>
<br/>
# If the [[test/]] directory is no longer required, as root, enter the following command to remove it, as well as all files in it: <br/>
<br/><br/> sudo  rm -ri /test/<br/>
<br/>
# If [[star]] is no longer required, as root, remove the package: <br/>
<br/><br/> sudo  yum remove star<br/>
<br/>
See the star(1) manual page for further information about [[star]].
=== 4.11. Information Gathering Tools ===
The utilities listed below are command-line tools that provide well-formatted information, such as access vector cache statistics or the number of classes, types, or Booleans.
==== avcstat ====
This command provides a short output of the access vector cache statistics since boot. You can watch the statistics in real time by specifying a time interval in seconds. This provides updated statistics since the initial output. The statistics file used is [[/sys/fs/selinux/avc/cache_stats]], and you can specify a different cache file with the [[-f /path/to/file]] option.
sudo  avcstat
lookups hits misses allocs reclaims frees
47517410 47504630 12780 12780 12176 12275
==== seinfo ====
This utility is useful in describing the break-down of a policy, such as the number of classes, types, Booleans, allow rules, and others. [[seinfo]] is a command-line utility that uses a [[policy.conf]] file, a binary policy file, a modular list of policy packages, or a policy list file as input. You must have the setools-console package installed to use the [[seinfo]] utility.
The output of [[seinfo]] will vary between binary and source files. For example, the policy source file uses the [[{ }]] brackets to group multiple rule elements onto a single line. A similar effect happens with attributes, where a single attribute expands into one or many types. Because these are expanded and no longer relevant in the binary policy file, they have a return value of zero in the search results. However, the number of rules greatly increases as each formerly one line rule using brackets is now a number of individual lines.
Some items are not present in the binary policy. For example, neverallow rules are only checked during policy compile, not during runtime, and initial Security Identifiers (SIDs) are not part of the binary policy since they are required prior to the policy being loaded by the kernel during boot.
sudo  seinfo
Statistics for policy file: /sys/fs/selinux/policy
Policy Version & Type: v.28 (binary, mls)
Classes: 77 Permissions: 229
Sensitivities: 1 Categories: 1024
Types: 3001 Attributes: 244
Users: 9 Roles: 13
Booleans: 158 Cond. Expr.: 193
Allow: 262796 Neverallow: 0
Auditallow: 44 Dontaudit: 156710
Type_trans: 10760 Type_change: 38
Type_member: 44 Role allow: 20
Role_trans: 237 Range_trans: 2546
Constraints: 62 Validatetrans: 0
Initial SIDs: 27 Fs_use: 22
Genfscon: 82 Portcon: 373
Netifcon: 0 Nodecon: 0
Permissives: 22 Polcap: 2
The [[seinfo]] utility can also list the number of types with the domain attribute, giving an estimate of the number of different confined processes:
sudo  seinfo -adomain -x | wc -l
550
Not all domain types are confined. To look at the number of unconfined domains, use the [[unconfined_domain]] attribute:
sudo  seinfo -aunconfined_domain_type -x | wc -l
52
Permissive domains can be counted with the [[--permissive]] option:
sudo  seinfo --permissive -x | wc -l
31
Remove the additional [[ wc -l]] command in the above commands to see the full lists.
==== sesearch ====
You can use the [[sesearch]] utility to search for a particular rule in the policy. It is possible to search either policy source files or the binary file. For example:
~]$ sesearch --role_allow -t httpd_sys_content_t
Found 20 role allow rules:
allow system_r sysadm_r;
allow sysadm_r system_r;
allow sysadm_r staff_r;
allow sysadm_r user_r;
allow system_r git_shell_r;
allow system_r guest_r;
allow logadm_r system_r;
allow system_r logadm_r;
allow system_r nx_server_r;
allow system_r staff_r;
allow staff_r logadm_r;
allow staff_r sysadm_r;
allow staff_r unconfined_r;
allow staff_r webadm_r;
allow unconfined_r system_r;
allow system_r unconfined_r;
allow system_r user_r;
allow webadm_r system_r;
allow system_r webadm_r;
allow system_r xguest_r;
The [[sesearch]] utility can provide the number of ''allow'' rules:
sudo  sesearch --allow | wc -l
262798
And the number of ''dontaudit'' rules:
sudo  sesearch --dontaudit | wc -l
156712
=== 4.12. Prioritizing and Disabling SELinux Policy Modules ===
The SELinux module storage in [[/etc/selinux/]] allows using a priority on SELinux modules. Enter the following command as root to show two module directories with a different priority:
sudo  ls /etc/selinux/targeted/active/modules
100 400 disabled
While the default priority used by [[semodule]] utility is 400, the priority used in selinux-policy packages is 100, so you can find most of the SELinux modules installed with the priority 100.
You can override an existing module with a modified module with the same name using a higher priority. When there are more modules with the same name and different priorities, only a module with the highest priority is used when the policy is built.
'''Example&nbsp;4.1.&nbsp;Using SELinux Policy Modules Priority'''
Prepare a new module with modified file context. Install the module with the [[semodule -i]] command and set the priority of the module to 400. We use [[sandbox.pp]] in the following example.
sudo  semodule -X 400 -i sandbox.pp
sudo  semodule --list-modules=full | grep sandbox
400 sandbox pp
100 sandbox pp
To return back to the default module, enter the [[semodule -r]] command as root:
sudo  semodule -X 400 -r sandbox
libsemanage.semanage_direct_remove_key: sandbox module at priority 100 is now active.
==== Disabling a System Policy Module ====
To disable a [[system policy]] module, enter the following command as root:
semodule -d ''MODULE_NAME''
'''Warning'''
If you remove a [[system policy]] module using the [[semodule -r]] command, it is deleted on your system's storage and you cannot load it again. To avoid unnecessary reinstallations of the selinux-policy-targeted package for restoring all [[system policy]] modules, use the [[semodule -d]] command instead.
=== 4.13. Multi-Level Security (MLS) ===
The Multi-Level Security technology refers to a security scheme that enforces the Bell-La Padula Mandatory Access Model. Under MLS, users and processes are called ''subjects'', and files, devices, and other passive components of the system are called ''objects''. Both subjects and objects are labeled with a security level, which entails a subject's clearance or an object's classification. Each security level is composed of a ''sensitivity'' and a ''category'', for example, an internal release schedule is filed under the internal documents category with a confidential sensitivity.
Figure&nbsp;4.1, “Levels of clearance” shows levels of clearance as originally designed by the US defense community. Relating to our internal schedule example above, only users that have gained the confidential clearance are allowed to view documents in the confidential category. However, users who only have the confidential clearance are not allowed to view documents that require higher levels or clearance; they are allowed read access only to documents with lower levels of clearance, and write access to documents with higher levels of clearance.
'''Figure&nbsp;4.1.&nbsp;Levels of clearance'''
Figure&nbsp;4.2, “Allowed data flows using MLS” shows all allowed data flows between a subject running under the "Secret" security level and various objects with different security levels. In simple terms, the Bell-LaPadula model enforces two properties: ''no read up'' and ''no write down''.
'''Figure&nbsp;4.2.&nbsp;Allowed data flows using MLS'''
==== 4.13.1. MLS and System Privileges ====
MLS access rules are always combined with conventional access permissions (file permissions). For example, if a user with a security level of "Secret" uses Discretionary Access Control (DAC) to block access to a file by other users, this also blocks access by users with a security level of "Top Secret". It is important to remember that SELinux MLS policy rules are checked ''after'' DAC rules. A higher security clearance does not automatically give permission to arbitrarily browse a file system.
Users with top-level clearances do not automatically acquire administrative rights on multi-level systems. While they may have access to all information on the computer, this is different from having administrative rights.
==== 4.13.2. Enabling MLS in SELinux ====
'''Note'''
It is not recommended to use the MLS policy on a system that is running the X Window System.
Follow these steps to enable the SELinux MLS policy on your system.
'''Procedure&nbsp;4.19.&nbsp;Enabling SELinux MLS Policy'''# Install the selinux-policy-mls package: <br/>
<br/><br/> sudo  yum install selinux-policy-mls<br/>
<br/>
# Before the MLS policy is enabled, each file on the file system must be relabeled with an MLS label. When the file system is relabeled, confined domains may be denied access, which may prevent your system from booting correctly. To prevent this from happening, configure [[SELINUX=permissive]] in the [[/etc/selinux/config]] file. Also, enable the MLS policy by configuring [[SELINUXTYPE=mls]]. Your configuration file should look like this: <br/>
<br/><br/># This file controls the state of SELinux on the system.<br/># SELINUX= can take one of these three values:<br/>#  enforcing - SELinux security policy is enforced.<br/>#  permissive - SELinux prints warnings instead of enforcing.<br/>#  disabled - No SELinux policy is loaded.<br/>SELINUX=permissive<br/># SELINUXTYPE= can take one of these two values:<br/>#  targeted - Targeted processes are protected,<br/>#  mls - Multi Level Security protection.<br/>SELINUXTYPE=mls<br/>
<br/>
# Make sure SELinux is running in permissive mode: <br/>
<br/><br/> sudo  setenforce 0<br/>
<br/><br/><br/><br/><br/>~]$ getenforce<br/>Permissive<br/>
<br/>
# Use the [[fixfiles]] script to create the [[/.autorelabel]] file containing the [[-F]] option to ensure that files are relabeled upon next reboot: <br/>
<br/><br/> sudo  fixfiles -F onboot<br/>
<br/>
# Reboot your system. During the next boot, all file systems will be relabeled according to the MLS policy. The label process labels all files with an appropriate SELinux context: <br/>
<br/><br/>*** Warning -- SELinux mls policy relabel is required.<br/>*** Relabeling could take a very long time, depending on file<br/>*** system size and speed of hard drives.<br/>***********<br/>
<br/><br/>Each [[*]] (asterisk) character on the bottom line represents 1000 files that have been labeled. In the above example, eleven [[*]] characters represent 11000 files which have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes. Once the labeling process finishes, the system will automatically reboot.
# In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as root, enter the following command to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. See Chapter&nbsp;11, ''Troubleshooting'' for troubleshooting information if SELinux denied access during boot. <br/>
<br/><br/> sudo  grep "SELinux is preventing" /var/log/messages<br/>
<br/>
# If there were no denial messages in the [[/var/log/messages]] file, or you have resolved all existing denials, configure [[SELINUX=enforcing]] in the [[/etc/selinux/config]] file: <br/>
<br/><br/># This file controls the state of SELinux on the system.<br/># SELINUX= can take one of these three values:<br/>#  enforcing - SELinux security policy is enforced.<br/>#  permissive - SELinux prints warnings instead of enforcing.<br/>#  disabled - No SELinux policy is loaded.<br/>SELINUX=enforcing<br/># SELINUXTYPE= can take one of these two values:<br/>#  targeted - Targeted processes are protected,<br/>#  mls - Multi Level Security protection.<br/>SELINUXTYPE=mls<br/>
<br/>
# Reboot your system and make sure SELinux is running in enforcing mode: <br/>
<br/><br/>~]$ getenforce<br/>Enforcing<br/>
<br/><br/>and the MLS policy is enabled: <br/>
<br/><br/> sudo  sestatus |grep mls<br/>Policy from config file: mls<br/>
<br/>
==== 4.13.3. Creating a User With a Specific MLS Range ====
Follow these steps to create a new Linux user with a specific MLS range:
'''Procedure&nbsp;4.20.&nbsp;Creating a User With a Specific MLS Range'''# Add a new Linux user using the [[useradd]] command and map the new Linux user to an existing SELinux user (in this case, [[staff_u]]): <br/>
<br/><br/> sudo  useradd -Z staff_u john<br/>
<br/>
# Assign the newly-created Linux user a password: <br/>
<br/><br/>prompt sudo  passwd john<br/>
<br/>
# Enter the following command as root to view the mapping between SELinux and Linux users. The output should be as follows: <br/>
<br/><br/> sudo  semanage login -l<br/>Login Name SELinux User MLS/MCS Range Service<br/>
__default__ user_u s0-s0 *<br/>john staff_u s0-s15:c0.c1023 *<br/>root root s0-s15:c0.c1023 *<br/>staff staff_u s0-s15:c0.c1023 *<br/>sysadm staff_u s0-s15:c0.c1023 *<br/>system_u system_u s0-s15:c0.c1023 *<br/>
<br/>
# Define a specific range for user [[john]]: <br/>
<br/><br/> sudo  semanage login --modify --range s2:c100 john<br/>
<br/>
# View the mapping between SELinux and Linux users again. Note that the user [[john]] now has a specific MLS range defined: <br/>
<br/><br/> sudo  semanage login -l<br/>Login Name SELinux User MLS/MCS Range Service<br/>
__default__ user_u s0-s0 *<br/>john staff_u s2:c100 *<br/>root root s0-s15:c0.c1023 *<br/>staff staff_u s0-s15:c0.c1023 *<br/>sysadm staff_u s0-s15:c0.c1023 *<br/>system_u system_u s0-s15:c0.c1023 *<br/>
<br/>
# To correct the label on john's home directory if needed, enter the following command: <br/>
<br/><br/> sudo  chcon -R -l s2:c100 /home/john<br/>
<br/>
==== 4.13.4. Setting Up Polyinstantiated Directories ====
The [[/tmp]] and [[/var/tmp/]] directories are normally used for temporary storage by all programs, services, and users. Such setup, however, makes these directories vulnerable to race condition attacks, or an information leak based on file names. SELinux offers a solution in the form of ''polyinstantiated'' directories. This effectively means that both [[/tmp]] and [[/var/tmp/]] are instantiated, making them appear private for each user. When instantiation of directories is enabled, each user's [[/tmp]] and [[/var/tmp/]] directory is automatically mounted under [[/tmp-inst]] and [[/var/tmp/tmp-inst]].
Follow these steps to enable polyinstantiation of directories:
'''Procedure&nbsp;4.21.&nbsp;Enabling Polyinstantiation Directories'''# Uncomment the last three lines in the [[/etc/security/namespace.conf]] file to enable instantiation of the [[/tmp]], [[/var/tmp/]], and users' home directories: <br/>
<br/><br/>~]$ tail -n 3 /etc/security/namespace.conf<br/>/tmp /tmp-inst/ level root,adm<br/>/var/tmp /var/tmp/tmp-inst/ level root,adm<br/>$HOME $HOME/$USER.inst/ level<br/>
<br/>
# Ensure that in the [[/etc/pam.d/login]] file, the [[pam_namespace.so]] module is configured for session: <br/>
<br/><br/>~]$ grep namespace /etc/pam.d/login<br/>session required pam_namespace.so<br/>
<br/>
# Reboot your system.
=== 4.14. File Name Transition ===
The ''file name transition'' feature allows policy writers to specify the file name when writing policy transition rules. It is possible to write a rule that states: If a process labeled [[A_t]] creates a specified object class in a directory labeled [[B_t]] and the specified object class is named [[objectname]], it gets the label [[C_t]]. This mechanism provides more fine-grained control over processes on the system.
Without file name transition, there are three possible ways how to label an object: * By default, objects inherit labels from parent directories. For example, if the user creates a file in a directory labeled [[etc_t]], then the file is labeled also [[etc_t]]. However, this method is useless when it is desirable to have multiple files within a directory with different labels.
* Policy writers can write a rule in policy that states: If a process with type [[A_t]] creates a specified object class in a directory labeled [[B_t]], the object gets the new [[C_t]] label. This practice is problematic if a single program creates multiple objects in the same directory where each object requires a separate label. Moreover, these rules provide only partial control, because names of the created objects are not specified.
* Certain applications have SELinux awareness that allow such an application to ask the system what the label of a certain path should be. These applications then request the kernel to create the object with the required label. Examples of applications with SELinux awareness are the '''rpm''' package manager, the '''restorecon''' utility, or the '''udev''' device manager. However, it is not possible to instruct every application that creates files or directories with SELinux awareness. It is often necessary to relabel objects with the correct label after creating. Otherwise, when a confined domain attempts to use the object, AVC messages are returned.
The file name transition feature decreases problems related to incorrect labeling and improves the system to be more secure. Policy writers are able to state properly that a certain application can only create a file with a specified name in a specified directory. The rules take into account the file name, not the file path. This is the basename of the file path. Note that file name transition uses an exact match done by the [[strcmp()]] function. Use of regular expressions or wildcard characters is not considered.
'''Note'''
File paths can vary in the kernel and file name transition does not use the paths to determine labels. Consequently, this feature only affects initial file creation and does not fix incorrect labels of already created objects.
'''Example&nbsp;4.2.&nbsp;Examples of Policy Rules Written with File Name Transition'''
The example below shows a policy rule with file name transition:
filetrans_pattern(unconfined_t, admin_home_t, ssh_home_t, dir, ".ssh")
This rule states that if a process with the [[unconfined_t]] type creates the [[~/.ssh/]] directory in a directory labeled [[admin_home_t]], the [[~/.ssh/]] directory gets the label [[ssh_home_t]].
Similar examples of policy rules written with file name transition are presented below:
filetrans_pattern(staff_t, user_home_dir_t, httpd_user_content_t, dir, "public_html")
filetrans_pattern(thumb_t, user_home_dir_t, thumb_home_t, file, "missfont.log")
filetrans_pattern(kernel_t, device_t, xserver_misc_device_t, chr_file, "nvidia0")
filetrans_pattern(puppet_t, etc_t, krb5_conf_t, file, "krb5.conf")
'''Note'''
The file name transition feature affects mainly policy writers, but users can notice that instead of file objects almost always created with the default label of the containing directory, some file objects have a different label as specified in policy.
=== 4.15. Disabling ptrace() ===
The [[ptrace()]] system call allows one process to observe and control the execution of another process and change its memory and registers. This call is used primarily by developers during debugging, for example when using the [[strace]] utility. When [[ptrace()]] is not needed, it can be disabled to improve system security. This can be done by enabling the [[deny_ptrace]] Boolean, which denies all processes, even those that are running in [[unconfined_t]] domains, from being able to use [[ptrace()]] on other processes.
The [[deny_ptrace]] Boolean is disabled by default. To enable it, run the [[setsebool -P deny_ptrace on]] command as the root user:
sudo  setsebool -P deny_ptrace on
To verify if this Boolean is enabled, use the following command:
~]$ getsebool deny_ptrace
deny_ptrace --> on
To disable this Boolean, run the [[setsebool -P deny_ptrace off]] command as root:
sudo  setsebool -P deny_ptrace off
'''Note'''
The [[setsebool -P]] command makes persistent changes. Do not use the [[-P]] option if you do not want changes to persist across reboots.
This Boolean influences only packages that are part of Red&nbsp;Hat&nbsp;Enterprise&nbsp;Linux. Consequently, third-party packages could still use the [[ptrace()]] system call. To list all domains that are allowed to use [[ptrace()]], enter the following command. Note that the setools-console package provides the [[sesearch]] utility and that the package is not installed by default.
sudo  sesearch -A -p ptrace,sys_ptrace -C | grep -v deny_ptrace | cut -d ' ' -f 5
=== 4.16. Thumbnail Protection ===
The thumbnail icons can potentially allow an attacker to break into a locked machine using removable media, such as USB devices or CDs. When the system detects a removable media, the Nautilus file manager executes the thumbnail driver code to display thumbnail icons in an appropriate file browser even if the machine is locked. This behavior is unsafe because if the thumbnail executables were vulnerable, the attacker could use the thumbnail driver code to bypass the lock screen without entering the password.
Therefore, a new SELinux policy is used to prevent such attacks. This policy ensures that all thumbnail drivers are locked when the screen is locked. The thumbnail protection is enabled for both confined users and unconfined users. This policy affects the following applications: * /usr/bin/evince-thumbnailer
* /usr/bin/ffmpegthumbnailer
* /usr/bin/gnome-exe-thumbnailer.sh
* /usr/bin/gnome-nds-thumbnailer
* /usr/bin/gnome-xcf-thumbnailer
* /usr/bin/gsf-office-thumbnailer
* /usr/bin/raw-thumbnailer
* /usr/bin/shotwell-video-thumbnailer
* /usr/bin/totem-video-thumbnailer
* /usr/bin/whaaw-thumbnailer
* /usr/lib/tumbler-1/tumblerd
* /usr/lib64/tumbler-1/tumblerd
[3] To temporarily revert to the default behavior, as the Linux root user, run the [[setsebool httpd_can_network_connect_db off]] command. For changes that persist across reboots, run the [[setsebool -P httpd_can_network_connect_db off]] command.
[4] Files in the [[/etc/selinux/targeted/contexts/files/]] directory define contexts for files and directories. Files in this directory are read by the [[restorecon]] and [[setfiles]] utilities to restore files and directories to their default contexts.
[5] Morris, James. "Filesystem Labeling in SELinux". Published 1 October 2004. Accessed 14 October 2008: http://www.linuxjournal.com/article/7426.
[6] See the matchpathcon(8) manual page for further information about [[matchpathcon]].


[[Kategorie:SELinux/DOC]]
[[Kategorie:SELinux/DOC]]

Version vom 23. März 2026, 13:40 Uhr

SELinux/DOC/01 Einführung

Beschreibung

Was ist SELinux?
  • SELinux bietet eine zusätzliche Ebene der Systemsicherheit
SELinux beantwortet im Wesentlichen die Frage
„Darf <Subjekt> die <Aktion> an <Objekt> ausführen?“
Beispiel
„Darf ein Webserver auf Dateien in den Home-Verzeichnissen der Benutzer zugreifen?“
Umfassende und fein abgestufte Sicherheitsrichtlinien

Die standardmäßige Zugriffsrichtlinie, die auf Benutzer-, Gruppen- und anderen Berechtigungen basiert und als Discretionary Access Control (DAC) bekannt ist, ermöglicht es Systemadministratoren nicht, umfassende und fein abgestufte Sicherheitsrichtlinien zu erstellen, wie beispielsweise bestimmte Anwendungen darauf zu beschränken, Log-Dateien nur anzuzeigen, während anderen Anwendungen erlaubt wird, neue Daten an die Log-Dateien anzuhängen

SELinux implementiert Mandatory Access Control (MAC)
  • Jeder Prozess und jede Systemressource verfügt über eine spezielle Sicherheitskennzeichnung, die als „SELinux-Kontext“ bezeichnet wird
  • Ein SELinux-Kontext, manchmal auch als „SELinux-Label“ bezeichnet, ist ein Identifikator, der die Details auf Systemebene abstrahiert und sich auf die Sicherheitseigenschaften der Entität konzentriert
  • Dies bietet nicht nur eine konsistente Methode zur Referenzierung von Objekten in der SELinux-Richtlinie, sondern beseitigt auch jegliche Mehrdeutigkeit, die bei anderen Identifizierungsmethoden auftreten kann; beispielsweise kann eine Datei auf einem System, das Bind-Mounts verwendet, mehrere gültige Pfadnamen haben
Kontexte

Die SELinux-Richtlinie verwendet diese Kontexte in einer Reihe von Regeln, die definieren, wie Prozesse miteinander und mit den verschiedenen Systemressourcen interagieren können

  • Standardmäßig erlaubt die Richtlinie keine Interaktion, es sei denn, eine Regel gewährt ausdrücklich Zugriff
Hinweis
Es ist wichtig zu beachten, dass SELinux-Richtlinienregeln nach den DAC-Regeln überprüft werden
  • SELinux-Richtlinienregeln werden nicht angewendet, wenn DAC-Regeln den Zugriff zuerst verweigern, was bedeutet, dass keine SELinux-Verweigerung protokolliert wird, wenn die herkömmlichen DAC-Regeln den Zugriff verhindern
Felder

SELinux-Kontexte bestehen aus mehreren Feldern

  • Benutzer
  • Rolle
  • Typ
  • Sicherheitsstufe
Typinformationen

Die SELinux-Typinformationen sind für die SELinux-Richtlinie wohl am wichtigsten, da die gängigste Richtliniendevise, die die zulässigen Interaktionen zwischen Prozessen und Systemressourcen definiert, SELinux-Typen und nicht den vollständigen SELinux-Kontext verwendet

  • SELinux-Typen enden in der Regel mit _t
  • Der Typname für den Webserver lautet beispielsweise httpd_t
  • Der Typkontext für Dateien und Verzeichnisse, die normalerweise unter /var/www/html/ zu finden sind, ist httpd_sys_content_t
  • Der Typkontext für Dateien und Verzeichnisse, die sich normalerweise in /tmp und /var/tmp/ befinden, lautet tmp_t
  • Der Typkontext für Webserver-Ports lautet http_port_t
Richtlinienregel

Es gibt etwa eine Richtlinienregel, die Apache (dem als httpd_t ausgeführten Webserver-Prozess) den Zugriff auf Dateien und Verzeichnisse mit einem Kontext erlaubt, der normalerweise in /var/www/html/ und anderen Webserver-Verzeichnissen (httpd_sys_content_t) zu finden ist

  • Da die Richtlinie keine Zulassungsregel für Dateien enthält, die sich normalerweise in /tmp und /var/tmp/ befinden, ist der Zugriff nicht erlaubt
  • Mit SELinux kann ein bösartiges Skript selbst dann nicht auf das Verzeichnis /tmp zugreifen, wenn Apache kompromittiert wurde und es Zugriff erlangt hat

Abbildung 1.1

HTTPD
  • SELinux erlaubt dem als httpd_t laufenden Apache-Prozess den Zugriff auf das Verzeichnis /var/www/html/ und verweigert demselben Prozess den Zugriff auf das Verzeichnis /data/mysql/, da es keine Zulassungsregel für die Kontexte vom Typ httpd_t und mysqld_db_t gibt
  • Andererseits kann der als mysqld_t ausgeführte MariaDB-Prozess auf das Verzeichnis /data/mysql/ zugreifen, und SELinux verweigert dem Prozess vom Typ mysqld_t korrekt den Zugriff auf das als httpd_sys_content_t gekennzeichnete Verzeichnis /var/www/html/.‚‘'

Vorteile

SELinux bietet die folgenden Vorteile

Labels

Alle Prozesse und Dateien sind mit Labels versehen

Richtlinienregeln

SELinux-Richtlinienregeln definieren, wie Prozesse mit Dateien interagieren sowie wie Prozesse miteinander interagieren

  • Zugriff ist nur dann erlaubt, wenn eine SELinux-Richtlinienregel existiert, die dies ausdrücklich erlaubt

Fein abgestimmte Zugriffskontrolle

  • Über die traditionellen UNIX-Berechtigungen hinaus, die nach dem Ermessen des Benutzers gesteuert werden und auf Linux-Benutzer- und Gruppen-IDs basieren, basieren SELinux-Zugriffsentscheidungen auf allen verfügbaren Informationen, wie z. B. einem SELinux-Benutzer, einer Rolle, einem Typ und optional einer Sicherheitsstufe
  • Die SELinux-Richtlinie wird administrativ definiert und systemweit durchgesetzt
  • Verbesserte Abwehr von Angriffen zur Privilegieneskalation
  • Prozesse laufen in Domänen und sind daher voneinander getrennt
  • SELinux-Richtlinienregeln legen fest, wie Prozesse auf Dateien und andere Prozesse zugreifen
  • Wenn ein Prozess kompromittiert wird, hat der Angreifer nur Zugriff auf die normalen Funktionen dieses Prozesses und auf Dateien, für die der Prozess konfiguriert

wurde, darauf zuzugreifen

  • Wenn beispielsweise der Apache-HTTP-Server kompromittiert wird, kann ein Angreifer diesen Prozess nicht nutzen, um Dateien in Benutzer-Home-Verzeichnissen zu lesen, es sei denn, eine spezifische SELinux-Richtlinienregel wurde hinzugefügt oder so konfiguriert, dass sie einen solchen Zugriff erlaubt
  • SELinux kann eingesetzt werden, um die Vertraulichkeit und Integrität von Daten zu gewährleisten sowie Prozesse vor nicht vertrauenswürdigen Eingaben zu schützen
SELinux ist jedoch nicht
  • Antivirensoftware
  • ein Ersatz für Passwörter, Firewalls und andere Sicherheitssysteme
  • eine All-in-One-Sicherheitslösung

SELinux wurde entwickelt, um bestehende Sicherheitslösungen zu ergänzen, nicht um sie zu ersetzen

  • Auch bei der Verwendung von SELinux ist es wichtig, weiterhin bewährte Sicherheitspraktiken zu befolgen, wie z. B. die Aktualisierung von Software, die Verwendung schwer zu erratender Passwörter oder den Einsatz von Firewalls

Beispiele

Die folgenden Beispiele veranschaulichen, wie SELinux die Sicherheit erhöht:

Standardaktion „verweigern“
  • Wenn keine SELinux-Richtlinienregel existiert, die den Zugriff erlaubt, beispielsweise für einen Prozess, der eine Datei öffnet, wird der Zugriff verweigert
Benutzer einschränken
  • SELinux kann Linux-Benutzer einschränken
  • In der SELinux-Richtlinie gibt es eine Reihe von eingeschränkten SELinux-Benutzern
  • Linux-Benutzer können eingeschränkten SELinux-Benutzern zugeordnet werden, um die für diese geltenden Sicherheitsregeln und -mechanismen zu nutzen
  • Wenn beispielsweise ein Linux-Benutzer dem SELinux-Benutzer ```user_u``` zugeordnet wird, führt dies dazu, dass dieser Linux-Benutzer (sofern nicht anders konfiguriert) keine Set-User-ID-Anwendungen (setuid) wie ```sudo``` und ```su``` ausführen kann
  • Weitere Informationen finden Sie in Abschnitt 3.3, „Eingeschränkte und uneingeschränkte Benutzer“
Verbesserte Prozess- und Datentrennung
  • Prozesse laufen in ihren eigenen Domänen, wodurch verhindert wird, dass Prozesse auf Dateien zugreifen, die von anderen Prozessen verwendet werden, und dass Prozesse auf andere Prozesse zugreifen
  • Wenn beispielsweise SELinux ausgeführt wird, kann ein Angreifer – sofern nicht anders konfiguriert – keinen Samba-Server kompromittieren und diesen Samba-Server dann als Angriffsvektor nutzen, um auf Dateien zu lesen und zu schreiben, die von anderen Prozessen verwendet werden, wie z. B. MariaDB-Datenbanken
SELinux hilft dabei, den durch Konfigurationsfehler verursachten Schaden zu mindern
  • Domain Name System (DNS)-Server replizieren häufig Informationen untereinander in einem sogenannten Zonentransfer
  • Angreifer können Zonentransfers nutzen, um DNS-Server mit falschen Informationen zu aktualisieren
  • Wenn Berkeley Internet Name Domain (BIND) als DNS-Server unter Linux ausgeführt wird, verhindert die Standard-SELinux-Richtlinie – selbst wenn ein Administrator vergisst, einzuschränken, welche Server einen Zonentransfer durchführen dürfen –, dass Zonendateien [1] durch Zonentransfers, durch den BIND-Daemon named selbst oder durch andere Prozesse aktualisiert werden
Hintergrundinformationen

zu SELinux sowie Informationen zu verschiedenen Exploits, die SELinux verhindert hat, finden Sie im Artikel auf NetworkWorld.com: „A seatbelt for server software: SELinux blocks real-world exploits“[2]

Architektur

SELinux ist ein Linux Security Module (LSM), das in den Linux-Kernel integriert ist

  • Das SELinux-Subsystem im Kernel wird von einer Sicherheitsrichtlinie gesteuert, die vom Administrator kontrolliert und beim Systemstart geladen wird
  • Alle sicherheitsrelevanten Zugriffsvorgänge auf Kernel-Ebene im System werden von SELinux abgefangen und im Kontext der geladenen Sicherheitsrichtlinie geprüft
  • Wenn die geladene Richtlinie den Vorgang zulässt, wird er fortgesetzt
  • Andernfalls wird der Vorgang blockiert und der Prozess erhält eine Fehlermeldung

SELinux-Entscheidungen, wie das Zulassen oder Verweigern von Zugriff, werden zwischengespeichert

  • Dieser Cache wird als Access Vector Cache (AVC) bezeichnet
  • Durch die Verwendung dieser zwischengespeicherten Entscheidungen müssen die SELinux-Richtlinienregeln weniger häufig überprüft werden, was die Leistung erhöht
  • Beachten Sie, dass SELinux-Richtlinienregeln keine Wirkung haben, wenn DAC-Regeln den Zugriff zuvor verweigern

Zustände und Modi

SELinux kann in einem von drei Modi ausgeführt werden: deaktiviert, permissiv oder durchgesetzt

Vom deaktivierten Modus wird dringend abgeraten; das System verzichtet nicht nur auf die Durchsetzung der SELinux-Richtlinie, sondern auch auf die Kennzeichnung persistenter Objekte wie Dateien, was eine spätere Aktivierung von SELinux erschwert

Im permissiven Modus verhält sich das System so, als würde SELinux die geladene Sicherheitsrichtlinie durchsetzen, einschließlich der Kennzeichnung von Objekten und der Ausgabe von Zugriffsverweigerungseinträgen in den Protokollen, doch werden tatsächlich keine Operationen verweigert

  • Der permissive Modus wird zwar nicht für Produktionssysteme empfohlen, kann jedoch bei der Entwicklung von SELinux-Richtlinien hilfreich sein

Der Durchsetzungsmodus ist der standardmäßige und empfohlene Betriebsmodus; im Durchsetzungsmodus arbeitet SELinux normal und setzt die geladene Sicherheitsrichtlinie im gesamten System durch

Verwenden Sie das Dienstprogramm setenforce, um zwischen dem Durchsetzungs- und dem permissiven Modus zu wechseln

  • Mit setenforce vorgenommene Änderungen bleiben nach einem Neustart nicht erhalten
  • Um in den Durchsetzungsmodus zu wechseln, geben Sie als Linux-Root-Benutzer den Befehl setenforce 1 ein
  • Um in den permissiven Modus zu wechseln, geben Sie den Befehl setenforce 0 ein
  • Verwenden Sie das Dienstprogramm getenforce, um den aktuellen SELinux-Modus anzuzeigen:
sudo  getenforce
Durchsetzungsmodus

sudo  setenforce 0
sudo  getenforce
Erlaubter Modus

sudo  setenforce 1
sudo  getenforce
Durchsetzungsmodus

In Linux können Sie einzelne Domänen in den permissiven Modus versetzen, während das System im Enforcing-Modus läuft

  • Um beispielsweise die Domäne httpd_t in den permissiven Modus zu versetzen:
sudo  semanage permissive -a httpd_t

Weitere Informationen finden Sie in Abschnitt 11.3.4, „Permissive Domänen“

Hinweis
Dauerhafte Änderungen an Zuständen und Modi werden in Abschnitt 4.4, „Dauerhafte Änderungen an SELinux-Zuständen und -Modi“, behandelt



Anhang

Siehe auch

Dokumentation

Projekt

  1. Red Hat Identity Management (IdM)
    • bietet eine zentralisierte Lösung zur Definition von SELinux-Benutzerzuordnungen
    • Weitere Informationen finden Sie unter „Defining SELinux User Maps“ im „Linux Domain Identity, Authentication, and Policy Guide“
  2. Marti, Don. „Ein Sicherheitsgurt für Server-Software: SELinux blockiert reale Exploits“
    • Veröffentlicht am 24. Februar 2008. Abgerufen am 27. August 2009: http://www.networkworld.com/article/2283723/lan-wan/a-seatbelt-for-server-software--selinux-blocks-real-world-exploits.html
  3. Die Manpage selinux(8) und die Manpages, die mit dem Befehl apropos selinux aufgelistet werden
  4. Man-Seiten, die mit dem Befehl man -k _selinux aufgelistet werden, wenn das Paket selinux-policy-doc installiert ist
  5. Das SELinux-Farbbuch
  6. SELinux-Wiki-FAQ


Abgerufen von „https://wiki.foxtom.de/index.php?title=Linux/SELinux/01_Grundlagen&oldid=162025“