Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
In this exercise, you will use system tools to examine the system's current SELinux policy, and to interpret whether or not specific SELinux domains used by processes have access to files and ports labeled with specific SELinux types.
Outcomes
You should be able to:
Use policy tools to predict what SELinux domain the process will have when it is run, based on the SELinux type on an executable.
Determine what SELinux types may be accessed by that process and what access is permitted or blocked.
Determine whether or not a particular SELinux domain can transition to
unconfined_t, and whether or notunconfined_tcan transition to that domain.
Confirm that the workstation and serverc machines are started.
Log in to workstation as student using student as the password.
On workstation, run lab selinux-audit setup to verify that the environment is ready.
This script also installs httpd on serverc.
[student@workstation ~]$lab selinux-audit setup
Use the SELinux policy tools to predict the SELinux domain type for the
httpddaemon whensystemdstarts the service.Log in to
servercasstudent. No password is required.[student@workstation ~]$ssh student@serverc[student@serverc ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@serverc ~]$sudo -i[sudo] password for student:student[root@serverc ~]#Install the policycoreutils-devel and setools-console packages to provide the sepolicy and sesearch commands, respectively.
[root@serverc ~]#yum install policycoreutils-devel setools-console...output omitted... Is this ok [y/d/N]:y...output omitted... Complete!When using systemctl to start a service, the command forwards the request to the
systemddaemon. Use the ps -Z command to retrieve the SELinux domain type of thesystemddaemon.[root@serverc ~]#ps -Z -C systemdLABEL PID TTY TIME CMD system_u:system_r:init_t:s0 1 ? 00:00:27 systemdThe
systemddaemon starts the service by executing thehttpdbinary file. Use the ls -Z command to retrieve the SELinux context type of thehttpdexecutable.[root@serverc ~]#which httpd/sbin/httpd[root@serverc ~]#ls -Z /sbin/httpd-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /sbin/httpdUse the sesearch command to retrieve the SELinux domain transition rule for when a daemon of type
init_texecutes a program of typehttpd_exec_t.[root@serverc ~]#sesearch -T -s init_t -t httpd_exec_tFound 1 semantic te rules: type_transition init_t httpd_exec_t : processhttpd_t;The SELinux domain type of the resulting process is
httpd_t.Use the sepolicy transition command as another way to list domain transitions.
[root@serverc ~]#sepolicy transition -s init_t -t httpd_tinit_t @ httpd_exec_t --> httpd_t init_t ... initrc_t @ httpd_exec_t --> httpd_t init_t ... initrc_t ... vpnc_t ... ifconfig_t ... iptables_t ... insmod_t ... mount_t ... glusterd_t @ httpd_exec_t --> httpd_t init_t ... initrc_t ... vpnc_t ... ifconfig_t ... iptables_t ... insmod_t ... mount_t ... glusterd_t ... udev_t ... cupsd_config_t ... cupsd_t ... logrotate_t @ httpd_exec_t --> httpd_t ...output omitted...The sepolicy transition command displays all the transition paths between a source and a target domain. The first line indicates a direct transition by execution of a binary with the
httpd_exec_ttype. Notice that for the sepolicy transition command, the-toption is the target domain type. For the sesearch command,-tis the SELinux type of the program file.Confirm your observation by starting the
httpdservice and getting the domain type of the resultinghttpdprocesses.[root@serverc ~]#systemctl start httpd[root@serverc ~]#ps -Z -C httpdLABEL PID TTY TIME CMD system_u:system_r:httpd_t:s0 1826 ? 00:00:01 httpd system_u:system_r:httpd_t:s0 1827 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1828 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1829 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1830 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1831 ? 00:00:00 httpd
Manually start the
httpddaemon, without using systemctl. Observe and explain the resulting SELinux domain type.Stop the
httpdservice.[root@serverc ~]#systemctl stop httpd[root@serverc ~]#Directly start the
httpddaemon, without using systemctl.[root@serverc ~]#httpd[root@serverc ~]#Red Hat does not recommend starting services this way. Always use the systemctl command.
Retrieve the SELinux domain type of the
httpddaemon.[root@serverc ~]#ps -Z -C httpdLABEL PID TTY TIME CMD unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1856 ? 00:00:00 httpd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1857 ? 00:00:00 httpd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1858 ? 00:00:00 httpd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1859 ? 00:00:00 httpd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1860 ? 00:00:00 httpd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1861 ? 00:00:00 httpdThe
httpddomain type isunconfined_t.The source domain that started the
httpddaemon is your Bash shell. Retrieve the SELinux type of your shell.[root@serverc ~]#ps -Z $$LABEL PID TTY STAT TIME COMMAND unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1735 pts/0 S 0:00 -bash$$is the PID of the current process.Use the sesearch command to look for a domain transition rule from the
unconfined_tsource type to theunconfined_tdomain type when executing a program with thehttpd_exec_ttype.[root@serverc ~]#sesearch -T -s unconfined_t -t httpd_exec_t[root@serverc ~]#There is no such rule. Therefore, the daemon resulting from the execution of
/sbin/httpdinherits the domain type of the program that launches the command; your shell is this example.Clean up by killing the
httpdprocesses and restarting the service with systemctl.[root@serverc ~]#pkill httpd[root@serverc ~]#systemctl start httpd[root@serverc ~]#
Create a test HTML page, and locate the rule that allows the
httpddaemon to read that file.Create the test page,
index.html, in thehttpdDocumentRootdirectory,/var/www/html/. Use curl to confirm that you can access the new page.[root@serverc ~]#cd /var/www/html[root@serverc html]#echo "Hello World" > ./index.html[root@serverc html]#curl http://localhost/index.htmlHello WorldRetrieve the SELinux domain type of the
httpddaemon, and the type of theindex.htmlfile.[root@serverc html]#ps -Z -C httpdLABEL PID TTY TIME CMD system_u:system_r:httpd_t:s0 1952 ? 00:00:02 httpd system_u:system_r:httpd_t:s0 1953 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1954 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1955 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1956 ? 00:00:00 httpd system_u:system_r:httpd_t:s0 1957 ? 00:00:00 httpd[root@serverc html]#ls -Z ./index.html-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 ./index.htmlUse the sesearch command to retrieve the rule that allows the
httpd_tdomain type to read files with thehttpd_sys_content_ttype.[root@serverc html]#sesearch -A -s httpd_t -t httpd_sys_content_t \>-c fileFound 5 semantic av rules: allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ;allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock open } ;allow httpd_t httpdcontent : file { ioctl read write create getattr setattr lock append unlink link rename open } ; allow httpd_t httpdcontent : file { read getattr execute open } ; allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ;
Locate the rule that allows the
httpddaemon to execute CGI scripts in the/var/www/cgi-bin/directory.Retrieve the SELinux context type of the
/var/www/cgi-bin/directory.[root@serverc html]#ls -Zd /var/www/cgi-bin/drwxr-xr-x. root root system_u:object_r:httpd_sys_script_exec_t:s0 /var/www/cgi-bin/CGI scripts in this directory also inherit that context.
Use the sesearch command to retrieve the rule that allows the
httpd_tdomain type to execute files with thehttpd_sys_script_exec_ttype.[root@serverc html]#sesearch -A -s httpd_t \>-t httpd_sys_script_exec_t -c fileFound 4 semantic av rules: allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; allow httpd_t httpd_script_exec_type : file { ioctl read getattr lock open } ;allow httpd_t httpd_sys_script_exec_t : file { read getattr execute open } ;allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ;The previous rule depends on the
httpd_enable_cgiBoolean. Run the sesearch command again, but add the-Coption to display the Booleans associated with each rule.[root@serverc html]#sesearch -A -s httpd_t \>-t httpd_sys_script_exec_t -c file -CFound 4 semantic av rules: allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; allow httpd_t httpd_script_exec_type : file { ioctl read getattr lock open } ;ET allow httpd_t httpd_sys_script_exec_t : file { read getattr execute open } ; [httpd_enable_cgi] ET allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; [ httpd_builtin_scripting ]The
httpd_enable_cgiBoolean is currentlyon(E), therefore the rule applies.
Locate the rule that allows the
httpddaemon to bind to TCP port 80.Use the semanage port command to retrieve the SELinux type associated with TCP port 80.
[root@serverc html]#semanage port -l | grep 80...output omitted...http_port_ttcp80, 81, 443, 488, 8008, 8009, 8443, 9000 ...output omitted...Use the sesearch command to get the rule that allows the
httpd_tdomain type to bind to the ports with thehttp_port_ttype.[root@serverc html]#sesearch -A -s httpd_t -t http_port_tFound 11 semantic av rules:allow httpd_t http_port_t : tcp_socket name_bind ;...output omitted...
