SELinux tools

January 8, 2010

As SELinux is a bit of complicated compared to the tools that we use currently, I have thought it is good to have some tips here.

1) seinfo: This is the selinux query tool to see statistics about your policy.

[root@rh54-3 ~]# seinfo

Statistics for policy file: /etc/selinux/targeted/policy/policy.21
Policy Version & Type: v.21 (binary, MLS)

Classes:            61    Permissions:       220
Types:            1710    Attributes:        161
Users:               3    Roles:               6
Booleans:          242    Cond. Expr.:       222
Sensitivities:       1    Categories:       1024
Allow:          116810    Neverallow:          0
Auditallow:         41    Dontaudit:        6778
Role allow:          5    Role trans:          0
Type_trans:       1886    Type_change:         0
Type_member:         0    Range_trans:       317
Constraints:        47    Validatetrans:       0
Fs_use:             18    Genfscon:           74
Portcon:           323    Netifcon:

2) sesearch: This is a very handy tool. When I started using SELinux, I was thinking that processes with a specific type are only allowed to make operations of the same type:) how stupid I am. Then I have seen by experience that policy can defines it and to see what a source can do, we can use sesearch. For example to search for httpd_t type source in order to see in which types it is associated with issue the following;

[root@rh54-3 ~]# sesearch -s httpd_t -c file –allow
Found 103 av rules:
allow httpd_t etc_runtime_t : file { ioctl read getattr lock };
allow httpd_t httpd_var_lib_t : file { ioctl read write create getattr setattr lock append unlink link rename };
allow httpd_t httpd_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename };
allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock };
allow httpd_t public_content_rw_t : file { ioctl read getattr lock };
allow httpd_t httpd_bugzilla_htaccess_t : file { ioctl read getattr lock };
allow httpd_t mailman_data_t : file { ioctl read getattr lock };
allow httpd_t httpd_cvs_htaccess_t : file { ioctl read getattr lock };
allow httpd_t httpd_sys_htaccess_t : file { ioctl read getattr lock };
allow httpd_t squirrelmail_spool_t : file { ioctl read write create getattr setattr lock append unlink link rename };
allow httpd_t httpd_prewikka_htaccess_t : file { ioctl read getattr lock };
allow httpd_t locale_t : file { ioctl read getattr lock };
allow httpd_t var_auth_t : file { ioctl read write create getattr setattr lock append unlink link rename };
allow httpd_t etc_t : file { ioctl read getattr lock };
allow httpd_t fonts_t : file { ioctl read getattr lock };
allow httpd_t ld_so_t : file { ioctl read getattr lock execute };
allow httpd_t proc_t : file { ioctl read getattr lock };
allow httpd_t sysfs_t : file { ioctl read getattr lock };
allow httpd_t krb5_keytab_t : file { ioctl read getattr lock };
allow httpd_t httpd_config_t : file { ioctl read getattr lock };
allow httpd_t udev_tbl_t : file { ioctl read getattr lock };
allow httpd_t httpd_tmp_t : file { ioctl read write create getattr setattr lock append unlink link rename };
allow httpd_t shell_exec_t : file { ioctl read getattr lock execute execute_no_trans };
allow httpd_t cvs_data_t : file { ioctl read getattr lock };
allow httpd_t httpd_helper_exec_t : file { read getattr execute };
allow httpd_t ld_so_cache_t : file { ioctl read getattr lock };
allow httpd_t httpd_squirrelmail_t : file { ioctl read write create getattr setattr lock append unlink link rename };
allow httpd_t httpd_php_exec_t : file { read getattr execute };
allow httpd_t httpd_nagios_htaccess_t : file { ioctl read getattr lock };
allow httpd_t net_conf_t : file { ioctl read getattr lock };

3) Restorecon

This is a very useful utility that allows you to restore types configured statically in the system. The only thing you should do is

#restorecon -R -v /data

However if your type is in /etc/selinux/targeted/contexts/customizable_types file then you have to add “-F” flag into the command, if you don’t nothing happens:)  As I have quoted text from Dan Walsh’s blog (RH engineer) , restorecon ignores these types and -F must be added.

  • customizable_types
    • These are a list of file types that restorecon will ignore.  So if you want to relabel your entire system using restorecon, and a file is labeled with a context in this file, the context will not be changed.  This can be overridden with the -F flag.  This allows you to specify special directories on your system as being readable by apache.  So if you chcon -R -t httpd_sys_content_t  /var/myhtml, a relabel will not change this directory tree back to var_t.

Selinux User Guide: http://docs.fedoraproject.org/selinux-user-guide/f12/en-US/index.html

tags:
posted in security by admin

Follow comments via the RSS Feed | Leave a comment | Trackback URL

6 Comments to "SELinux tools"

  1. ANGEL wrote:

    PillSpot.org. Canadian Health&Care.No prescription online pharmacy.Special Internet Prices.Pillspot.org. Vitamins@buy.online” rel=”nofollow”>.…

    Categories: Stomach.Antibiotics.Pain Relief.Blood Pressure/Heart.Weight Loss.Anxiety/Sleep Aid.Womens Health.Mental HealthAntiviral.Mens Health.Antidiabetic.Eye Care.Vitamins/Herbal Supplements.Skin Care.Stop SmokingAnti-allergic/Asthma.Antidepres…

  2. 1 wrote:

    1 http://04FORDPARTS.US/tag/1 : 18 Accessories Cars 118/…

    1…

  3. Laptop wrote:

    Apple http://rdelta0gc.copious-systems.com/tag/laptop+Apple+Laptop/ : Laptop…

    Apple…

  4. of wrote:

    Requirements http://cwarcraftlnm0i6.copious-systems.com/tag/Requirements+Computer+of/ : of…

    Computer…

  5. bega wrote:

    lighting http://qwood6qi.02JEEPPARTS.US/tag/bega+lighting+Lighting/ : Lighting…

    lighting…

  6. smokeless wrote:

    Products http://isanyok9n.APTAUTOPARTS.INFO/tag/Products+smokeless+sanyo/ : smokeless…

    sanyo…

Leave Your Comment

 
Powered by Wordpress and MySQL. Theme by Shlomi Noach, openark.org