🥇 Cheat Sheet for Sysadmins on SELinux: 42 Answers to Important Questions

The translation of the article is specially prepared for the students of the course Linux Administrator.

Here you will find answers to important questions about life, the universe, and everything related to Linux with enhanced security.

"The important truth that things are not always what they seem is well known…"

―Douglas Adams, The Hitchhiker's Guide to the Galaxy

Security. Reliability Enhancement. Compliance. Policy. The Four Horsemen of the Sysadmin Apocalypse. In addition to our daily tasks—monitoring, backup, deployment, configuration, updates, etc.—we are also responsible for the security of our systems. Even those systems where a third-party provider recommends disabling enhanced security. This is reminiscent of the work Ethan Hunt from "Mission: Impossible."

Faced with this dilemma, some system administrators decide to take the blue pill, because they think they'll never know the answer to the ultimate question of life, the universe, and everything. And, as we all know, that answer is 42.

In the spirit of "The Hitchhiker's Guide to the Galaxy," here are 42 answers to important questions about managing and using SELinux your systems.

1. SELinux is a mandatory access control system, meaning that every process has a label. Each file, directory, and system object also has labels. Policy rules manage access between labeled processes and objects. The kernel enforces these rules.

2. The two most important concepts are: Labeling — labeling (files, processes, ports, etc.) and Type enforcement (which isolates processes from each other based on types).

3. The correct label format user:role:type:level (optional).

4. The goal of providing multi-level security (Multi-Level Security — MLS) is to manage processes (domains) based on the security level of the data they will use. For example, a classified process cannot read top-secret data.

5. Providing multi-category security (Multi-Category Security — MCS) protects similar processes from each other (e.g., virtual machines, OpenShift mechanisms, SELinux sandboxes, containers, etc.).

6. Kernel parameters for changing SELinux modes at boot:

autorelabel=1 → causes the system to initiate relabeling
selinux=0 → kernel does not load the SELinux infrastructure
enforcing=0 → boots in permissive mode

7. If you need to relabel the entire system:

# touch /.autorelabel #reboot

If the system labeling contains a large number of errors, you may need to boot in permissive mode for the relabeling to be successful.

8. To check if SELinux is enabled: # getenforce

9. To temporarily enable/disable SELinux: # setenforce [1|0]

10. Checking SELinux status: # sestatus

11. Configuration file: /etc/selinux/config

12. How does SELinux work? Here is an example of labeling for the Apache web server:

Binary representation: /usr/sbin/httpd→httpd_exec_t
Configuration directory: /etc/httpd→httpd_config_t
Log file directory: /var/log/httpd → httpd_log_t
Content directory: /var/www/html → httpd_sys_content_t
Startup script: /usr/lib/systemd/system/httpd.service → httpd_unit_file_d
Process: /usr/sbin/httpd -DFOREGROUND → httpd_t
Ports: 80/tcp, 443/tcp → httpd_t, http_port_t

The process running in the context httpd_t, can interact with the object labeled httpd_something_t.

13. Many commands take the argument -Z to view, create, and change context:

ls -Z
id -Z
ps -Z
netstat -Z
cp -Z
mkdir -Z

Contexts are set when files are created based on the context of their parent directory (with some exceptions). RPMs can set contexts during installation.

14. There are four main reasons for SELinux errors, described in more detail in points 15-21 below:

Labeling problems
Due to something SELinux needs to know
An error in SELinux policy/application
Your information may be compromised

15. Labeling issue: if your files are /srv/myweb incorrectly labeled, access may be denied. Here are a few ways to fix this:

If you know the label:
# semanage fcontext -a -t httpd_sys_content_t '/srv/myweb(/.*)?'
If you know the file with the equivalent label:
# semanage fcontext -a -e /srv/myweb /var/www
Restore the context (for both cases):
# restorecon -vR /srv/myweb

16. Labeling problem: if you move a file instead of copying it, the file will retain its original context. To fix this issue:

Change the context command with the label:
# chcon -t httpd_system_content_t /var/www/html/index.html
Change the context command with the link label:
# chcon --reference /var/www/html/ /var/www/html/index.html
Restore the context (for both cases): # restorecon -vR /var/www/html/

17. If SELinux needs to know, that HTTPD is listening on port 8585, inform SELinux:

# semanage port -a -t http_port_t -p tcp 8585

18. SELinux needs to know Boolean values allowing parts of the SELinux policy to be changed at runtime without knowledge of rewriting the SELinux policy. For example, if you want httpd to send email, enter: # setsebool -P httpd_can_sendmail 1

19. SELinux needs to know Boolean values for enabling/disabling SELinux settings:

To see all Boolean values: # getsebool -a
To see the description of each: # semanage boolean -l
To set a Boolean value: # setsebool [_boolean_] [1|0]
For permanent setting, add -P. For example: # setsebool httpd_enable_ftp_server 1 -P

20. SELinux policy/application may contain errors, including:

Unusual code paths
Configurations
Redirecting stdout
File descriptor leaks
Executable memory
Poorly constructed libraries

Open tickets (do not submit reports to Bugzilla; there is no SLA in Bugzilla).

21. Your information may be compromised, if you have limited domains attempting to:

Load kernel modules
Disable enforced mode of SELinux
Write to etc_t/shadow_t
Change iptables rules

22. SELinux tools for policy module development:

# yum -y install setroubleshoot setroubleshoot-server

Reboot or restart auditd after installation.

23. Use

journalctl

to display a list of all logs related to setroubleshoot:

# journalctl -t setroubleshoot --since=14:20

24. Use journalctl to display a list of all logs related to a specific SELinux label. For example:

# journalctl _SELINUX_CONTEXT=system_u:system_r:policykit_t:s0

25. When encountering an SELinux error, use the log setroubleshoot with suggestions for several possible solutions.
For example, from journalctl:

Jun 14 19:41:07 web1 setroubleshoot: SELinux is preventing httpd from getattr access on the file /var/www/html/index.html. For complete message run: sealert -l 12fd8b04-0119-4077-a710-2d0e0ee5755e

# sealert -l 12fd8b04-0119-4077-a710-2d0e0ee5755e
SELinux is preventing httpd from getattr access on the file /var/www/html/index.html.

***** Plugin restorecon (99.5 confidence) suggests ************************

If you want to fix the label,
/var/www/html/index.html default label should be httpd_syscontent_t.
Then you can restorecon.
Do
# /sbin/restorecon -v /var/www/html/index.html

26. Logging: SELinux logs information in many places:

/var/log/messages
/var/log/audit/audit.log
/var/lib/setroubleshoot/setroubleshoot_database.xml

27. Logging: searching for SELinux errors in the audit log:

# ausearch -m AVC,USER_AVC,SELINUX_ERR -ts today

28. To find SELinux Access Vector Cache (AVC) messages for a specific service:

# ausearch -m avc -c httpd

29. Utility audit2allow gathers information from logs of denied operations and then generates SELinux permission policy rules. For example:

To create a human-readable description of the access denial reason: # audit2allow -w -a
To view the mandatory type enforcement rule that allows the denied access: # audit2allow -a
To create a custom module: # audit2allow -a -M mypolicy
Option -M creates a mandatory type enforcement file (.te) with the specified name and compiles the rule into a policy package (.pp): mypolicy.pp mypolicy.te
To install a custom module: # semodule -i mypolicy.pp

30. To configure an individual process (domain) to run in permissive mode: # semanage permissive -a httpd_t

31. If you no longer want the domain to be permissive: # semanage permissive -d httpd_t

32. To disable all permissive domains: # semodule -d permissivedomains

33. Enabling SELinux MLS policy: # yum install selinux-policy-mls in /etc/selinux/config:

SELINUX=permissive
SELINUXTYPE=mls

Ensure that SELinux is running in permissive mode: # setenforce 0
Use the script fixfiles, to ensure that files will be re-labeled on the next reboot:

# fixfiles -F onboot # reboot

34. Create a user with a specific MLS range: # useradd -Z staff_u john

Using the command useradd, map the new user to an existing SELinux user (in this case, staff_u).

35. To view the mapping between SELinux users and Linux: # semanage login -l

36. Define a specific range for the user: # semanage login --modify --range s2:c100 john

37. To correct the label in the user's home directory (if necessary): # chcon -R -l s2:c100 /home/john

38. To view the current categories: # chcat -L

39. To change categories or start creating your own, modify the file as follows:

/etc/selinux/_<selinuxtype>_/setrans.conf

40. To run a command or script in a specific file, role, and user context:

# runcon -t initrc_t -r system_r -u user_u yourcommandhere

-t file context
-r role context
-u user context

41. Containers running with SELinux disabled:

Podman: # podman run --security-opt label=disable …
Docker: # docker run --security-opt label=disable …

42. If you need to grant the container full access to the system:

Podman: # podman run --privileged …
Docker: # docker run --privileged …

And now you already know the answer. So please: do not panic and enable SELinux.

Links:

Source: habr.com

Cheat sheet for system administrators on SELinux: 42 answers to important questions

Links: