{"id":36280,"date":"2019-10-31T22:10:39","date_gmt":"2019-10-31T19:10:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rukovodstvo-dlya-nachinayushhih-po-selinux\/"},"modified":"2019-10-31T22:10:39","modified_gmt":"2019-10-31T19:10:39","slug":"rukovodstvo-dlya-nachinayushhih-po-selinux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/rukovodstvo-dlya-nachinayushhih-po-selinux","title":{"rendered":"Beginner's guide to SELinux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Beginner's<\/p>\n

<\/p>\n

The translation of the article is prepared for the students of the course Linux Security<\/a><\/noindex><\/em><\/p>\n

SELinux, or Security Enhanced Linux, is an advanced access control mechanism developed by the U.S. National Security Agency (NSA) to prevent malicious intrusions. It implements a mandatory access control (MAC) model over the existing discretionary access control (DAC) model, meaning permissions for reading, writing, and executing.<\/a><\/noindex><\/p>\n

<\/p>\n

SELinux has three modes:<\/p>\n

<\/p>\n

    \n
  1. Enforcing<\/strong> \u2014 access is denied based on policy rules.<\/li>\n
  2. Permissive<\/strong> \u2014 logs actions that violate the policy, which would be denied in enforcing mode.<\/li>\n
  3. Disabled<\/strong> \u2014 SELinux is completely turned off.<\/li>\n<\/ol>\n

    <\/p>\n

    By default, settings are located in \/etc\/selinux\/config<\/code><\/p>\n

    <\/p>\n

    Changing SELinux Modes<\/h1>\n

    <\/p>\n

    To check the current mode, run <\/p>\n

    <\/p>\n

    $ getenforce<\/code><\/pre>\n
    <\/p>\n
    To change the mode to permissive, execute the following command <\/p>\n
    <\/p>\n
    $ setenforce 0<\/code><\/pre>\n
    <\/p>\n
    or, to change from permissive<\/strong> to to enforcing<\/strong>, run <\/p>\n
    <\/p>\n
    $ setenforce 1<\/code><\/pre>\n
    <\/p>\n
    If you need to completely disable SELinux, this can only be done through the configuration file <\/p>\n
    <\/p>\n
    $ vi \/etc\/selinux\/config<\/code><\/pre>\n
    <\/p>\n
    To disable it, change the SELINUX parameter as follows:<\/p>\n
    <\/p>\n
    SELINUX=disabled<\/code><\/pre>\n
    <\/p>\n
    Configuring SELinux<\/h1>\n
    <\/p>\n
    Each file and process is tagged with a SELinux context that contains additional information such as user, role, type, etc. If you are enabling SELinux for the first time, you need to set up the context and labels first. The process of assigning labels and context is known as labeling. To start labeling, change the mode in the configuration file to permissive<\/strong>.<\/p>\n
    <\/p>\n
    $ vi \/etc\/selinux\/config\nSELINUX=permissive<\/code><\/pre>\n
    <\/p>\n
    After setting the mode permissive<\/strong>, create an empty hidden file named .autorelabel<\/code><\/p>\n
    <\/p>\n
    $ touch \/.autorelabel<\/code><\/pre>\n
    <\/p>\n
    and reboot your computer<\/p>\n
    <\/p>\n
    $ init 6<\/code><\/pre>\n
    <\/p>\n
    Note: We use permissive mode for labeling since using enforcing mode may cause system crashes during reboot. permissive<\/strong> Don't worry if the boot gets stuck on a file; labeling takes some time. Once labeling is completed and your system has booted, you can go to the configuration file and set the mode to enforcing<\/strong> , and also run:<\/p>\n
    <\/p>\n
    Now you have successfully enabled SELinux on your computer. to enforcing<\/strong>Monitoring logs<\/p>\n
    <\/p>\n
    $ setenforce 1<\/code><\/pre>\n
    <\/p>\n
    You have successfully enabled SELinux on your computer. <\/p>\n
    <\/p>\n
    Monitoring logs<\/h1>\n
    <\/p>\n
    You might have encountered some errors during labeling or while the system was running. To check whether your SELinux is functioning correctly and not blocking access to any port, application, etc., you need to review the logs. The SELinux log is located in \/var\/log\/audit\/audit.log<\/code>, but you don't need to read it entirely to find errors. You can use the audit2why utility to search for errors. Run the following command:<\/p>\n
    <\/p>\n
    $ audit2why < \/var\/log\/audit\/audit.log<\/code><\/pre>\n
    <\/p>\n
    As a result, you will receive a list of errors. If there are no errors in the log, no messages will be displayed.<\/p>\n
    <\/p>\n
    Configuring SELinux Policy<\/h1>\n
    <\/p>\n
    SELinux policy is a set of rules that the SELinux security mechanism follows. The policy defines a set of rules for a specific environment. Now we will study how to configure policies to allow access to prohibited services.<\/p>\n
    <\/p>\n
    1. Boolean Values (Switches)<\/h4>\n
    <\/p>\n
    Booleans allow changing parts of the policy at runtime, without needing to create new policies. They allow modifications without reloading or recompiling the SELinux policies.<\/p>\n
    <\/p>\n
    Example<\/strong>
    \nSuppose we want to share the user's home directory over FTP with read and write access, and we have already shared it, but when trying to access it we see nothing. This is because the SELinux policy prevents the FTP server from reading and writing to the user's home directory. We need to change the policy so that the FTP server can access home directories. Let's check if there are any switches for this by executing<\/p>\n
    <\/p>\n
    $ semanage boolean -l<\/code><\/pre>\n
    <\/p>\n
    This command will provide a list of available booleans with their current state (on or off) and description. You can refine your search by adding grep to find results related only to ftp:<\/p>\n
    <\/p>\n
    $ semanage boolean -l | grep ftp<\/code><\/pre>\n
    <\/p>\n
    and you will find the following<\/p>\n
    <\/p>\n
    ftp_home_dir -> off       Allow ftp to read & write file in user home directory<\/code><\/pre>\n
    <\/p>\n
    This switch is off, so we will enable it using setsebool ftp_home_dir on<\/code><\/p>\n
    <\/p>\n
    Now our FTP daemon can access the user's home directory.
    \nNote: You can also get a list of available booleans without descriptions by executing getsebool -a<\/code><\/p>\n
    <\/p>\n
    2. Labels and Context<\/h4>\n
    <\/p>\n
    This is the most common way to implement SELinux policy. Each file, folder, process, and port is labeled with a SELinux context:<\/p>\n
    <\/p>\n