Protect services with SELinux

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Examendoelen in dit hoofdstuk

SELinux in enforcing- of permissive-modus zetten
SELinux-context van bestanden en processen tonen en lezen
De standaard bestandscontexten herstellen
SELinux-poortlabels beheren
Booleans gebruiken om SELinux-instellingen te wijzigen

Understand why SELinux matters

Normal permissions check who you are (user, group). SELinux checks what program you are: the web server (type httpd_t) may read web files (httpd_sys_content_t), but not /etc/shadow (shadow_t) — even when it runs as root.

Everything has a context (label): processes, files, ports.
The policy (rules from Red Hat) says which process types may do what with which object types.
What is not allowed is denied and logged as an AVC message.

Onthoud

Most SELinux problems come from a wrong file label, a non-standard port, or a boolean that is off. Fix those — do not disable SELinux.

22.2

Know the SELinux modes

SELinux has three modes. Only enforcing protects the system.

Mode	Effect
`enforcing`	Rules are enforced and denials logged (default)
`permissive`	Nothing is blocked, but denials are logged (for troubleshooting)
`disabled`	SELinux is off; files get no labels (avoid!)

$getenforce
Enforcing
$sestatus
#setenforce 0
#setenforce 1
#grep ^SELINUX= /etc/selinux/config
SELINUX=enforcing

setenforce 0|1 switches between permissive and enforcing until the next reboot.
The mode at boot is set in /etc/selinux/config (SELINUX=enforcing|permissive).

One service can be permissive while the rest stays enforcing.

#semanage permissive -a httpd_t
#semanage permissive -d httpd_t

Examentip

SELinux must be enforcing at the end of the exam — services must work with it. Use permissive mode only to test if SELinux is the cause, then switch back.

Let op

To disable SELinux fully, RHEL needs the kernel argument selinux=0. Coming back from disabled needs a full relabel. Keep it on.

22.3

Read context labels

A context has four parts: user:role:type:level. For RHCSA work, the type (ending in _t) is what counts.

$ls -Z /var/www/html/index.html
unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html
$ls -Zd /home/student /etc/shadow
$ps -Z -C httpd
system_u:system_r:httpd_t:s0      1420 ?  00:00:00 httpd
$id -Z
#ss -tlnZ | grep :80

Part	Example	Meaning
user	`system_u`, `unconfined_u`	SELinux user
role	`object_r`, `system_r`	Role
type	`httpd_sys_content_t`	The important part
level	`s0`	MLS/MCS level (used for containers and VMs)

22.4

Set context types the right way

Write the rule in the policy with semanage fcontext, then apply it with restorecon. A label set this way survives a relabel.

Add a rule for a folder and everything in it.

#semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"

Apply the rule to the existing files.

#restorecon -Rv /srv/web
Relabeled /srv/web from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

Check.

$ls -Zd /srv/web
#semanage fcontext -l -C

Tool	Effect
`semanage fcontext -a` + `restorecon`	Permanent: rule in the policy + applied
`chcon -t TYPE FILE`	Temporary: lost at the next restorecon or relabel

Let op

chcon seems to work, but the next restorecon or relabel removes it. On the exam use semanage fcontext + restorecon.

22.5

Find the context type you need

Copy the type from the default folder of the service, search the policy rules, or read the service's SELinux man page.

$ls -Zd /var/www/html
#semanage fcontext -l | grep '/var/www'
#dnf install -y selinux-policy-doc
$man -k _selinux | grep httpd
$man httpd_selinux

Onthoud

selinux-policy-doc gives a man page per service (httpd_selinux, ftpd_selinux, samba_selinux …) with all types, booleans and ports.

22.6

Restore default file contexts

restorecon sets files back to the label the policy wants. Use it after moving files or when labels look wrong. For the whole system, ask for a relabel at the next boot.

#restorecon -Rv /var/www/html
#restorecon -Rvn /etc
#touch /.autorelabel
#fixfiles -F onboot

Notitie

mv keeps the old label, cp gives the label of the target folder. That is why moved web files often give "403 Forbidden".

22.7

Manage port access

Services may only listen on ports with the right type. To use a new port, add it to the type.

#semanage port -l | grep -E '^(http_port_t|ssh_port_t)'
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
ssh_port_t                     tcp      22
#semanage port -a -t http_port_t -p tcp 82
#semanage port -d -t http_port_t -p tcp 82
#semanage port -m -t http_port_t -p tcp 8080

Notitie

When a port is already defined for another type, -a fails ("already defined"); use -m (modify) instead.

22.8

Use booleans

Booleans are on/off switches for parts of the policy, like "may Apache connect to a database" or "may Apache serve home folders".

$getsebool -a | grep httpd
#semanage boolean -l | grep httpd_enable_homedirs
#setsebool httpd_enable_homedirs on
#setsebool -P httpd_enable_homedirs on
#semanage boolean -l -C

Without -P the change is lost at reboot.
semanage boolean -l shows the current and default state with a description.

Examentip

Always use setsebool -P on the exam, so the boolean survives the reboot.

22.9

Diagnose and fix SELinux denials

When SELinux blocks something, an AVC message goes to /var/log/audit/audit.log. Find it, read which source type, target type and class are involved, then fix the label, port or boolean.

Find recent denials.

#ausearch -m AVC -ts recent
type=AVC msg=audit(1729850000.123:412): avc:  denied  { read } for  pid=1421 comm="httpd" name="index.html" dev="dm-0" ino=1234 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
#journalctl -t setroubleshoot --since -1h

Read it: httpd_t tried to read a file with type user_home_t — the file has the wrong label.
Fix the label (or port, or boolean) and test again.
```
#restorecon -Rv /var/www/html
```

Part of the AVC	Meaning
`denied { read }`	The action that was blocked
`comm="httpd"`	The program
`scontext=…httpd_t…`	Source (process) type
`tcontext=…user_home_t…`	Target (file/port) type
`tclass=file`	Kind of object: file, dir, tcp_socket …

22.10

Make SELinux analysis easier

setroubleshoot-server explains each denial in plain text and suggests the fix.

#dnf install -y setroubleshoot-server
#sealert -a /var/log/audit/audit.log
#ausearch -m AVC -ts recent | audit2why

Op het werk

audit2allow can build a policy module from denials, but it allows exactly what was blocked — also an attack. Prefer labels, ports and booleans; write custom modules only when you understand every rule.

22.11

Remember the main points

The most important facts of this chapter, in short.

SELinux adds a second check after the normal permissions: a process type may only touch file and port types that the policy allows.
Modes: enforcing (blocks and logs), permissive (only logs), disabled. getenforce shows, setenforce 0|1 changes until reboot, /etc/selinux/config sets it for good.
See labels with ls -Z, ps -Z, id -Z.
Set a file type for good: semanage fcontext -a -t TYPE "/path(/.*)?", then restorecon -Rv /path. chcon changes only until the next relabel.
Ports: semanage port -l, -a to add, -m to change.
Booleans switch parts of the policy: getsebool -a, setsebool -P NAME on (-P = for good).
Denials are in /var/log/audit/audit.log; read them with ausearch -m avc or sealert -a (setroubleshoot).

22.12

Learn the key terms

The words of this chapter in simple English.

Term	Meaning
SELinux	Security-Enhanced Linux: rules about what each program may access.
Context (label)	The SELinux name of a file, process or port: user:role:type:level.
Type	The main part of a label used in the rules, like `httpd_t` or `httpd_sys_content_t`.
Policy	All SELinux rules of the system (targeted policy on RHEL).
Enforcing / permissive	Block and log / only log.
restorecon	Sets labels back to the policy default.
File context rule	A rule that says which label a path should have.
Boolean	An on/off switch for a part of the policy.
AVC denial	A log line about something SELinux blocked.