Protect the system with SELinux

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

SELinux-modi, contexten en booleans gebruiken en weigeringen oplossen

Know why SELinux matters

SELinux works by labels. Every process and every file has a label (the context). The policy says which process labels may use which file labels.

The Apache process has the type httpd_t.
Web files have the type httpd_sys_content_t. The policy says httpd_t may read them.
/etc/shadow has the type shadow_t. The policy says httpd_t may not read it — so even a hacked Apache can not.

Onthoud

When rights look right but access is still denied, think of SELinux first. Fix the label — do not turn SELinux off.

6.2

Read and change the mode

SELinux has three states: enforcing (blocks and logs), permissive (only logs) and disabled.

$getenforce
Enforcing
$sestatus
SELinux status:                 enabled
Current mode:                   enforcing
Mode from config file:          enforcing
Loaded policy name:             targeted
#setenforce 0
$getenforce
Permissive
#setenforce 1

/etc/selinux/config

SELINUX=enforcing
SELINUXTYPE=targeted

Change	Works	Lasts after reboot
`setenforce 0` / `1`	At once	No
`SELINUX=` in `/etc/selinux/config`	After a reboot	Yes
Kernel option `enforcing=0` (GRUB)	For one boot	No

Notitie

To turn SELinux off completely, RHEL uses the kernel option selinux=0 (grubby --update-kernel ALL --args selinux=0). Setting SELINUX=disabled in the config file is not the supported way any more. In a company, the answer is almost never "disable SELinux".

Op het werk

permissive is a good test: if the problem is gone in permissive mode, it is an SELinux problem. Then go back to enforcing and fix the label.

6.3

Show the contexts

-Z shows the SELinux context with many commands. The important part is the type (the third field, ending in _t).

$ls -Z /var/www/html/index.html
unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html
$ls -dZ /srv/web
unconfined_u:object_r:var_t:s0 /srv/web
$ps -eZ | grep httpd
system_u:system_r:httpd_t:s0     2210 ?        00:00:00 httpd
$id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

unconfined_u : object_r : httpd_sys_content_t : s0
   user         role          TYPE              level

6.4

Give files the right type for good

Write a rule with semanage fcontext, then apply it with restorecon. The rule stays — also after a full relabel.

#mkdir -p /srv/web
#semanage fcontext -a -t httpd_sys_content_t '/srv/web(/.*)?'
#restorecon -Rv /srv/web
Relabeled /srv/web from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
#semanage fcontext -l | grep '/srv/web'
#semanage fcontext -l -C
#semanage fcontext -d '/srv/web(/.*)?'

'/srv/web(/.*)?' means "the folder and everything inside it". Put it in single quotes.

Find the right type: look at a place that already works, or read the rules of the service.

$ls -dZ /var/www/html
$semanage fcontext -l | grep '/var/www'
$man -k _selinux
$man httpd_selinux

Let op

chcon -t TYPE FILE changes the label too, but only until the next restorecon or relabel. Use it only for a quick test.

6.5

Put labels back with restorecon

restorecon sets the label a file should have (from the rules). It fixes most labels broken by mv, cp -a from other places, or tar.

$mv ~/index.html /var/www/html/
$ls -Z /var/www/html/index.html
unconfined_u:object_r:user_home_t:s0 /var/www/html/index.html
#restorecon -v /var/www/html/index.html
#restorecon -Rv /var/www/html
#touch /.autorelabel

Onthoud

cp gives a new file the label of the target folder. mv keeps the old label. After mv, run restorecon. touch /.autorelabel and a reboot relabel the whole file system (takes minutes).

6.6

Switch features on with booleans

Booleans are on/off switches in the policy, for features that are off by default (Apache sending mail, home-folder web pages, NFS home folders …).

$getsebool -a | grep httpd | head
httpd_can_connect_db --> off
httpd_can_network_connect --> off
httpd_enable_homedirs --> off
$semanage boolean -l | grep httpd_can_network_connect
#setsebool -P httpd_can_network_connect on
#setsebool -P httpd_enable_homedirs on
$getsebool httpd_enable_homedirs
httpd_enable_homedirs --> on
$semanage boolean -l -C

Examentip

Always use -P with setsebool. Without it the change is lost at the next reboot.

6.7

Find and explain a denial

When SELinux blocks something, it writes an AVC message into /var/log/audit/audit.log. ausearch finds it; sealert and audit2why explain it.

#ausearch -m AVC -ts recent
type=AVC msg=audit(1761558300.112:412): avc:  denied  { getattr } for  pid=2211 comm="httpd" path="/srv/web/index.html" scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0
#ausearch -m AVC -ts recent | audit2why
#dnf install setroubleshoot-server
#sealert -a /var/log/audit/audit.log
#journalctl -t setroubleshoot --since today

Read the denial: who (scontext … httpd_t) wanted to do what (getattr) on which object (tcontext … var_t, the file). Here the file has the wrong type → fix it with semanage fcontext + restorecon.

Order of fixes:

Wrong file label? → semanage fcontext + restorecon.
A feature that is off? → setsebool -P.
A service on a non-standard port? → semanage port (see Protect network services).
Only when nothing fits: a small local policy module (audit2allow), after you understand the risk.

More: the RHCSA SELinux chapter.