Red Hat Security: Linux in Physical, Virtual, and Cloud

Objectives

After completing this section, students should be able to limit user access to the system and the root account by configuring them as confined users.

Defining SELinux Users

The SELinux policy defines its own SELinux users, which are distinct from Linux users. When a Linux user logs in, they are mapped to exactly one SELinux user. Like the Audit UID, the SELinux user cannot be changed during a login session. Normally, many Linux users may be mapped to the same SELinux user. The policy can place additional SELinux-enforced restrictions on what particular SELinux users can do.

You can list the SELinux users with semanage user -l command.

[root@demo ~]# semanage user -l

              Labeling  MLS/       MLS/
SELinux User  Prefix    MCS Level  MCS Range       SELinux Roles

guest_u       user      s0         s0              guest_r
root          user      s0         s0-s0:c0.c1023  staff_r sysadm_r system_r unconfined_r
staff_u       user      s0         s0-s0:c0.c1023  staff_r sysadm_r system_r unconfined_r
sysadm_u      user      s0         s0-s0:c0.c1023  sysadm_r
system_u      user      s0         s0-s0:c0.c1023  system_r unconfined_r
unconfined_u  user      s0         s0-s0:c0.c1023  system_r unconfined_r
user_u        user      s0         s0              user_r
xguest_u      user      s0         s0              xguest_r

Notice that each SELinux user has access to a set of SELinux roles, in the last column. These roles ultimately define which programs an SELinux user can run. For example, the sysadm_r role allows the use of the su and sudo commands. The xguest_r role restricts the commands that the user can use and only allows network access through Firefox.

The goal of this is to use SELinux to more tightly control the programs that a user can run.

Mapping Linux Users to SELinux Users

At login time, SELinux maps Linux users to SELinux users. This way, Linux users inherit the restrictions assigned to their associated SELinux users.

The semanage login -l command displays the table that SELinux uses for this mapping.

[root@demo ~]# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

From this output, you can see that SELinux maps the Linux root user to the unconfined_u SELinux user. The __default__ entry instructs SELinux to map all the Linux users that are not explicitly mapped to an SELinux user to the unconfined_u SELinux user. Linux users mapped to unconfined_u (the "unconfined user") do not have additional user-based SELinux restrictions. Other SELinux policy restrictions still apply.

SELinux uses the system_u user for system services. Do not use it for your Linux users.

Logged in Linux users can retrieve their associated SELinux user with the id -Z command.

[root@demo ~]# id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

To map an existing Linux user to an SELinux user, use the semanage login -a -s SELinux_user Linux_user command.

[root@demo ~]# semanage login -a -s sysadm_u  operator1

To remove the mapping, use the semanage login -d -s SELinux_user Linux_user command.

[root@demo ~]# semanage login -d -s sysadm_u  operator1

To modify the default mapping, use the semanage login -m -s SELinux_user -r s0 __default__ command.

[root@demo ~]# semanage login -m -s user_u -r s0 __default__

You can also map a new Linux user at creation time with the -Z option of the useradd command.

[root@demo ~]# useradd -Z staff_u developer1

Comparing the SELinux Users

On Red Hat Enterprise Linux, SELinux comes with a set of predefined SELinux users. You rarely have to create new ones because these existing users cover most use cases.

The following table lists the most useful confined SELinux users for system administration.

SELinux User Booleans

A number of Booleans can tune the restrictions set on confined users. The preceding table mentioned one, ssh_sysadm_login, which controls whether or not users mapped to sysadm_u can log in using ssh.

Another set of Booleans can be used to restrict whether or not these users can run executables in their home directory or in /tmp. These are user_exec_content, sysadm_exec_content, and staff_exec_content for user_u, sysadm_u, and staff_u respectively.

Confining User Accounts

Use the following guidelines to implement user confinement on your systems.

Confining Different User Accounts

When you decide to confine all of your Linux users, you usually start by modifying the default mapping to user_u.

[root@demo ~]# semanage login -m -s user_u -r s0 __default__

This way, SELinux confines all your Linux users to an SELinux user with minimal privileges, by default. If you use the default mapping, no further configuration is needed; SELinux automatically confines all existing users that do not have a mapping on their next login.

For extra protection, you can also prevent users in user_u from executing programs in their home directories and /tmp. To do that, set the user_exec_content Boolean to off.

[root@demo ~]# setsebool -P user_exec_content off

Confining System Administrators

To confine your system administrators, map their Linux account to the sysadm_u SELinux user. For existing accounts, use the semanage login -a command:

[root@demo ~]# semanage login -a -s sysadm_u  operator1

For new users, you can use the -Z option of the useradd command to do the mapping at user creation time.

[root@demo ~]# useradd -G wheel -Z sysadm_u operator2

Notice that the previous command uses the -G option to add the new account to the Linux wheel group to benefit from the existing sudo rule for this group.

By default, and for extra protection, users mapped to sysadm_u cannot use SSH to log in. Set the ssh_sysadm_login Boolean to on if you need to allow this access.

[root@demo ~]# setsebool -P ssh_sysadm_login on

Remember to remove the mapping when deleting the Linux user account.

[root@demo ~]# userdel operator1
[root@demo ~]# semanage login -d -s sysadm_u  operator1

You can also use userdel -Z to remove the mapping at the same time you delete the user account.

[root@demo ~]# userdel -Z operator2

Confining Staff Users

Some standard Linux users may need to run specific commands as root. Map them to the staff_u SELinux user account and configure sudo.

For existing accounts, use the semanage login -a command:

[root@demo ~]# semanage login -a -s staff_u  developer1

For new users, you can use the -Z option of the useradd command to do the mapping at user creation time.

[root@demo ~]# useradd -Z staff_u developer2

The next step is to configure the sudoers files to list the commands these users can run as root.

For extra protection, you can also prevent the staff_u SELinux users from executing programs in their home directories and /tmp. For that, set the staff_exec_content Boolean to off.

[root@demo ~]# setsebool -P staff_exec_content off

Remember to remove the mapping when deleting the Linux user account.

[root@demo ~]# userdel -Z developer1