The translation of the article is prepared for the students of the course Linux Security

SELinux, or Security Enhanced Linux, is an advanced access control mechanism developed by the U.S. National Security Agency (NSA) to prevent malicious intrusions. It implements a mandatory access control (MAC) model over the existing discretionary access control (DAC) model, meaning permissions for reading, writing, and executing.

SELinux has three modes:

1. Enforcing — access is denied based on policy rules.
2. Permissive — logs actions that violate the policy, which would be denied in enforcing mode.
3. Disabled — SELinux is completely turned off.

By default, settings are located in /etc/selinux/config

Changing SELinux Modes

To check the current mode, run

$ getenforce

To change the mode to permissive, execute the following command

$ setenforce 0

or, to change from permissive to to enforcing, run

$ setenforce 1

If you need to completely disable SELinux, this can only be done through the configuration file

$ vi /etc/selinux/config

To disable it, change the SELINUX parameter as follows:

SELINUX=disabled

Configuring SELinux

Each file and process is tagged with a SELinux context that contains additional information such as user, role, type, etc. If you are enabling SELinux for the first time, you need to set up the context and labels first. The process of assigning labels and context is known as labeling. To start labeling, change the mode in the configuration file to permissive.

$ vi /etc/selinux/config
SELINUX=permissive

After setting the mode permissive, create an empty hidden file named .autorelabel

$ touch /.autorelabel

and reboot your computer

$ init 6

Note: We use permissive mode for labeling since using enforcing mode may cause system crashes during reboot. permissive Don't worry if the boot gets stuck on a file; labeling takes some time. Once labeling is completed and your system has booted, you can go to the configuration file and set the mode to enforcing , and also run:

Now you have successfully enabled SELinux on your computer. to enforcingMonitoring logs

$ setenforce 1

You have successfully enabled SELinux on your computer.

Monitoring logs

You might have encountered some errors during labeling or while the system was running. To check whether your SELinux is functioning correctly and not blocking access to any port, application, etc., you need to review the logs. The SELinux log is located in /var/log/audit/audit.log, but you don't need to read it entirely to find errors. You can use the audit2why utility to search for errors. Run the following command:

$ audit2why < /var/log/audit/audit.log

As a result, you will receive a list of errors. If there are no errors in the log, no messages will be displayed.

Configuring SELinux Policy

SELinux policy is a set of rules that the SELinux security mechanism follows. The policy defines a set of rules for a specific environment. Now we will study how to configure policies to allow access to prohibited services.

1. Boolean Values (Switches)

Booleans allow changing parts of the policy at runtime, without needing to create new policies. They allow modifications without reloading or recompiling the SELinux policies.

Example
Suppose we want to share the user's home directory over FTP with read and write access, and we have already shared it, but when trying to access it we see nothing. This is because the SELinux policy prevents the FTP server from reading and writing to the user's home directory. We need to change the policy so that the FTP server can access home directories. Let's check if there are any switches for this by executing

$ semanage boolean -l

This command will provide a list of available booleans with their current state (on or off) and description. You can refine your search by adding grep to find results related only to ftp:

$ semanage boolean -l | grep ftp

and you will find the following

ftp_home_dir -> off       Allow ftp to read & write file in user home directory

This switch is off, so we will enable it using setsebool ftp_home_dir on

Now our FTP daemon can access the user's home directory.
Note: You can also get a list of available booleans without descriptions by executing getsebool -a

2. Labels and Context

This is the most common way to implement SELinux policy. Each file, folder, process, and port is labeled with a SELinux context:

• For files and directories, labels are stored as extended attributes in the file system and can be viewed using the following command:

  $ ls -Z /etc/httpd

• For processes and ports, the kernel manages the labeling, and you can check these labels as follows:

a process

$ ps –auxZ | grep httpd

The

$ netstat -anpZ | grep httpd

Example
Now, let's look at an example to better understand labels and context. Suppose we have web server, which is instead of a directory /var/www/html/ использует /home/dan/html/. SELinux will consider this a policy violation, and you will be unable to view your web pages. This is because we haven't set the security context associated with the HTML files. To view the default security context, use the following command:

$ ls –lz /var/www/html
 -rw-r—r—. root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/

Here we obtained httpd_sys_content_t as the context for HTML files. We need to set this security context for our current directory, which currently has the following context:

-rw-r—r—. dan dan system_u:object_r:user_home_t:s0 /home/dan/html/

An alternative command to check the security context of a file or directory:

$ semanage fcontext -l | grep '/var/www'

We will also use semanage to change the context after we find the correct security context. To change the context of /home/dan/html, execute the following commands:

$ semanage fcontext -a -t httpd_sys_content_t '/home/dan/html(\/.*)?'
$ semanage fcontext -l | grep '/home/dan/html'
/home/dan/html(\/.*)? all files system_u:object_r:httpd_sys_content_t:s0
$ restorecon -Rv /home/dan/html

After the context is changed using semanage, the restorecon command will load the default context for files and directories. Our web server will now be able to read files from the folder /home/dan/html, since the security context for this folder was changed to httpd_sys_content_t.

3. Creating Local Policies

There may be situations where the above methods are ineffective for you, and you encounter errors (avc/denial) in audit.log. When this happens, you need to create a local policy.

To resolve errors, you can create a local policy. For example, if we receive an error related to httpd (apache) or smbd (samba), we grep the errors and create a policy for them:

apache
$ grep httpd_t /var/log/audit/audit.log | audit2allow -M http_policy
samba
$ grep smbd_t /var/log/audit/audit.log | audit2allow -M smb_policy

Here http_policy and smb_policy — these are the names of local policies we created. Now we need to load these created local policies into the current SELinux policy. This can be done as follows:

$ semodule -I http_policy.pp
$ semodule -I smb_policy.pp

Our local policies have been loaded, and we should no longer receive any avc or denials in audit.log.

This was my attempt to help you understand SELinux. I hope that after reading this article, you will feel more comfortable with SELinux.

Source: habr.com