1) seinfo: This is the selinux query tool to see statistics about your policy.

2) sesearch: This is a very handy tool. When I started using SELinux, I was thinking that processes with a specific type are only allowed to make operations of the same type:) how stupid I am. Then I have seen by experience that policy can defines it and to see what a source can do, we can use sesearch. For example to search for httpd_t type source in order to see in which types it is associated with issue the following;

3) Restorecon

This is a very useful utility that allows you to restore types configured statically in the system. The only thing you should do is

However if your type is in /etc/selinux/targeted/contexts/customizable_types file then you have to add “-F” flag into the command, if you don’t nothing happens:)  As I have quoted text from Dan Walsh’s blog (RH engineer) , restorecon ignores these types and -F must be added.

• customizable_types
  • These are a list of file types that restorecon will ignore.  So if you want to relabel your entire system using restorecon, and a file is labeled with a context in this file, the context will not be changed.  This can be overridden with the -F flag.  This allows you to specify special directories on your system as being readable by apache.  So if you chcon -R -t httpd_sys_content_t  /var/myhtml, a relabel will not change this directory tree back to var_t.

Selinux User Guide: http://docs.fedoraproject.org/selinux-user-guide/f12/en-US/index.html

Literally the above line means ” Disable (-) all users’  (ALL) login access except (EXCEPT) root user (root) and allow root user to login via all terminals.

We haven’t finished yet as we must introduce this file into pam configuration. The necessary pam module is “pam_access” my new /etc/pam.d/login file is as follows:

By the default, the red line isn’t in this file. Once you add it, you will see that access restrictions are applied.

Edit the file /etc/pam.d/su :

If you uncomment the red line;

Then users have to be in wheel group in order to gain access to root privileges. Once you add your normal user into wheel user e.g

this test users can switch into root user.

DISPLAYING A REMOTE CERTIFICATE

DISPLAYING A LOCAL CERTIFICATE (FILE)

If you issue the following command for the certificate file (server.crt) locally saved, you will see the certificate details

“Setup samba in such a way that only users mert and yigit will be able to access the folder /samba_share in the server”

1) First create the folder and set the permissions for these users and adjust selinux settings.

From the getfacl output we can see that root,mert and yigit users have full access on this folder.

Now put this new share under the security context type of samba which is : samba_share_t

As it can be seen we have also added the folder into the policy so that if relabeling is performed, this folder won’t be affected.

2) Setup SAMBA config to allow access for these users

and reload samba

Note: As we have used “valid users” option for users, no other users are allowed even to display/login into this share. If we had written
“writable = no” and “write list = yigit mert” , then other users would have also gained access into this share.

3) Add these users into samba user list

4) Connect to samba server and send a test file followed by a deletion

As you can see sending and removing a file works for the user yigit, lets try for mert.

Great!! it has worked as well. POSIX access list is a great way when you have run out of tools in permission managament. It is by no means that involving SELinux also complicates things a bit. Fortunately there isn’t many booleans for SAMBA.

Please let me know if you have any questions in configuration or anything to add.

When your booelans is like above and you want to use your BIND as a slave server, you will get a SELinux blocking similar to below.

To get named update the zone files you have to toggle the boolean as below;

Then your zone files will be written properly.

SELinux modes

There three modes of SELinux

• Enforcing : You can restrict processes in this mode
• Permissive : You can see what might happen in the logs if the mode was Enforcing instead of Permissive.
• Disabled : Inactive state

You can query the runtime mode with “getenforce”:

or you can set the SELinux mode with “setenforce”:

Note: If you want to set the selinux mode to enforcing, you must reboot the server to relabel the filesystem. To have your changes to be persistent between reboots, set the SELinux mode in /etc/sysconfig/selinux file.

Redhat uses targeted policy by default which isn’t very strict and mainly service focused.

Security Context

When you label the file system some extra attributes are involved for each file, lets see them;

“ls -Z” shows us the security context “root:object_r:user_home_t”  of our files.  As you can see security context has three elements which are  user,role and type in which we will be dealing with the type part mainly.

In targeted mode SELinux systems, not all services are SELinux protected. If you want to see whether a service is protected or not you can issue;

You can see that httpd has a context and type is httpd_t.

Apache and SELinux

We will go by an example. SELinux mode is enforcing and we want to provide virtualhost services. Lets do it;

We have the following VirtualHost configuration in apache

Lets look at the security context of DocumentRoot

As you can see our type for this directory is httpd_sys_content_t. When you point your browser to http://rh54-3.iptables.gen.tr address you will see what is in that directory (e.g index.html)

What if we want to serve virtualhost in a different directory. What will happen?

Once you reload the configuration, you will notice that you can’t display the content of this new directory i.e /web/docs but why?

Lets look at the security context

From the security context, we see that the type for this “docs” folder is default_t and the SELinux policy currently active in the system doesn’t allow to access httpd process with httpd_t type into “/web/docs” folder.  Ok ok, what this means or how we can see that SELinux is preventing access. If your setroubleshoot service is running on the system, you will see SELinux messages in your logs. For example when I try to access this new virtualhost, I have got the following message in my log;

If you run the command log entry suggests, you will have the following output.

It tells us that something is wrong:) as we are trying to access directory that we aren’t allowed to. To solve this issue, we can change the context of the destination directory.

or you could have just copied the type from a known object into this one with;

Once you issue this command, all directories under this directory will be within httpd_sys_content_t which will allow httpd process to access because policy says so:)

However, if the filesystem is relabeled somehow, you will lose this labeling. If you want your change to survive during relabeling of the filesystems, then add this into the policy as follows;

However in the end, you didn’t like SELinux at all but you only want to disable SELinux for httpd. With the following command you can do this;

I have tried to talk about SELinux briefly. Main focus was apache but I will try to involve ftp,samba and NFS soon.

Please drop your comments if you have anything to add or any correction.