Red Hat System Administration II
- SectionChange the SELinux Enforcement Mode
- Guided Exercise: Change the SELinux Enforcement Mode
- Control SELinux File Contexts
- Guided Exercise: Control SELinux File Contexts
- Adjust SELinux Policy with Booleans
- Guided Exercise: Adjust SELinux Policy with Booleans
- Investigate and Resolve SELinux Issues
- Guided Exercise: Investigate and Resolve SELinux Issues
- Lab: Manage SELinux Security
- Summary
Abstract
| Goal | Protect and manage server security by using SELinux. |
| Objectives |
|
| Sections |
|
| Lab |
Manage SELinux Security |
Explain how SELinux protects resources, change the current SELinux mode of a system, and set the default SELinux mode of a system.
Security Enhanced Linux (SELinux) is a critical security feature of Linux. Access to files, ports, and other resources is controlled at a granular level. Processes are permitted to access only the resources that their SELinux policy or Boolean settings specify.
File permissions control file access for a specific user or group. However, file permissions do not prevent an authorized user with file access from using a file for an unintended purpose.
For example, with write access to a file, other editors or programs can still open and modify a structured data file that is designed for only a specific program to write to, which could result in corruption or a data security issue. File permissions do not stop such undesired access, because they do not control how a file is used but only who is allowed to read, write, or run a file.
SELinux consists of application-specific policies that the application's developers define to declare what actions and accesses are allowed for each binary executable, configuration file, and data file that the application uses. This policy is known as a targeted policy, because one policy defines an application's activities. Policies declare the predefined labels that are configured on individual programs, files, and network ports.
SELinux enforces a set of access rules that explicitly define allowed actions between processes and resources. Any action that is not defined in an access rule is not allowed. Because only defined actions are allowed, applications with a poor security design are still protected from malicious use. Applications or services with a targeted policy run in a confined domain, whereas an application without a policy runs unconfined but without any SELinux protection. Individual targeted policies can be disabled to assist with application and security policy development and debugging.
SELinux has the following operational modes:
Enforcing : SELinux enforces the loaded policies. This mode is the default in Red Hat Enterprise Linux.
Permissive : SELinux loads the policies and is active, but instead of enforcing access control rules, it logs access violations. This mode is helpful for testing and troubleshooting applications and rules.
Disabled : SELinux is turned off. SELinux violations are not denied or logged. Disabling SELinux is strongly discouraged.
Important
Starting in Red Hat Enterprise Linux 9, SELinux can be fully disabled only by using the selinux=0 kernel parameter at boot.
RHEL no longer supports setting the SELINUX=disabled option in the /etc/selinux/config file.
Starting in RHEL 9, disabling SELinux in the /etc/selinux/config file results in SELinux starting and performing active enforcement, but without loading any policies.
Because policy rules define allowed actions, if no policies are loaded then all actions are denied.
This behavior is intentional, and is designed to block malicious attempts to circumvent SELinux protection.
The primary goal of SELinux is to protect user data from improper use by compromised applications or system services. Most Linux administrators are familiar with the standard user, group, and world file permission security model, which is known as Discretionary Access Control (DAC) because administrators set file permissions as they need. SELinux provides an additional layer of object-based security, which is defined in granular rules, which are known as Mandatory Access Control (MAC) because MAC policies apply to all users and cannot be bypassed for specific users by discretionary configuration settings.
For example, a web server's open firewall port allows remote anonymous access to a web client.
However, a malicious user that accesses that port might try to compromise a system through an existing vulnerability.
If an example vulnerability compromises the permissions for the apache user and group, then a malicious user might directly access the /var/www/html document root content, or the system's /tmp and /var/tmp directories, or other accessible files and directories.
SELinux policies are security rules that define how specific processes access relevant files, directories, and ports. Every resource entity, such as a file, process, directory, or port, has a label called an SELinux context. The context label matches a defined SELinux policy rule to allow a process to access the labeled resource. By default, an SELinux policy does not allow any access unless an explicit rule grants access. When no allow rule is defined, all access is disallowed.
SELinux labels have user, role, type, and security level fields.
Targeted policy, which is enabled in RHEL by default, defines rules by using the type context.
Type context names typically end with _t.
For example, a web server process is labeled with the httpd_t type context.
Web server files and directories in the /var/www/html/ directory and other locations are labeled with the httpd_sys_content_t type context.
Temporary files in the /tmp and /var/tmp directories have the tmp_t type contexts as a label.
The web server's ports have the http_port_t type context as a label.
An Apache web server process runs with the httpd_t type context.
A policy rule permits the Apache server to access files and directories that are labeled with the httpd_sys_content_t type context.
By default, files in the /var/www/html directory have the httpd_sys_content_t type context.
A web server policy has by default no allow rules for using files that are labeled tmp_t, such as in the /tmp and /var/tmp directories, thus disallowing access.
With SELinux enabled, a malicious user who uses a compromised Apache process would still not have access to the /tmp directory files.
A MariaDB server process runs with the mysqld_t type context.
By default, files in the /data/mysql directory have the mysqld_db_t type context.
A MariaDB server can access the mysqld_db_t labeled files, but has no rules to allow access to files for other services, such as httpd_sys_content_t labeled files.
Many commands that list resources use the -Z option to manage SELinux contexts.
For example, the ps, ls, cp, and mkdir commands all use the -Z option.
[root@host ~]#ps axZLABEL PID TTY STAT TIME COMMAND system_u:system_r:kernel_t:s0 2 ? S 0:00 [kthreadd] system_u:system_r:kernel_t:s0 3 ? I< 0:00 [rcu_gp] system_u:system_r:kernel_t:s0 4 ? I< 0:00 [rcu_par_gp] ...output omitted... [root@host ~]#systemctl start httpd[root@host ~]#ps -ZC httpdLABEL PID TTY TIME CMD system_u:system_r:httpd_t:s0 1550 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1551 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1552 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1553 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1554 ? 00:00:00 httpd [root@host ~]#ls -Z /var/wwwsystem_u:object_r:httpd_sys_script_exec_t:s0 cgi-bin system_u:object_r:httpd_sys_content_t:s0 html
Use the getenforce command to view the current SELinux mode.
Use the setenforce command to change the SELinux mode.
[root@host ~]#getenforceEnforcing [root@host ~]#setenforceusage: setenforce [ Enforcing | Permissive | 1 | 0 ] [root@host ~]#setenforce 0[root@host ~]#getenforcePermissive [root@host ~]#setenforce Enforcing[root@host ~]#getenforceEnforcing
Alternatively, set the SELinux mode at boot time with a kernel parameter.
Pass the enforcing=0 kernel parameter to boot the system into permissive mode, or pass enforcing=1 to boot into enforcing mode.
Disable SELinux by passing the selinux=0 kernel parameter, or pass selinux=1 to enable SELinux.
Red Hat recommends rebooting the server when you change the SELinux mode from Permissive to Enforcing.
This reboot ensures that the services that are started in permissive mode are confined in the next boot.
To configure SELinux persistently, use the /etc/selinux/config file.
In the following default example, the configuration sets SELinux to the enforcing mode.
The comments list other valid values, such as the permissive and disabled modes.
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
...output omitted...
#
# NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
# grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
# grubby --update-kernel ALL --remove-args selinux
#
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targetedThe system reads this file at boot time and starts SELinux accordingly.
The selinux=0|1 and enforcing=0|1 kernel arguments override this configuration.
References
getenforce(8), setenforce(8), and selinux_config(5) man pages
