SELinux

Related articles
Security
AppArmor
TOMOYO Linux
Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies, including U.S. Department of Defense style
Mandatory Access Control
(MAC), through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of modifications that can be applied to Unix-like operating systems, such as Linux and BSD.
Running SELinux under a Linux distribution requires three things: An SELinux enabled kernel, SELinux Userspace tools and libraries, and SELinux Policies (mostly based on the Reference Policy). Some common Linux programs will also need to be patched/compiled with SELinux features.
Current status in Arch Linux
SELinux is not officially supported (see
[1]
[2]
). The status of unofficial support is:
Name
Status
Available at
SELinux enabled kernel
Implemented for all
officially supported kernels
Available in official repositories since
4.18.8
.
SELinux Userspace tools and libraries
Implemented in AUR:
https://aur.archlinux.org/packages/?O=0&K=selinux
Work is done at
https://github.com/archlinuxhardened/selinux
SELinux Policy
Work in progress, using
Reference Policy
as upstream
Upstream:
https://github.com/SELinuxProject/refpolicy
(since release 20170805 the policy has integrated support for systemd and single-/usr/bin directory)
Summary of changes in AUR as compared to official core packages:
Name
Status and comments
linux, linux-lts, linux-zen, linux-hardened
Need to
set the lsm= kernel parameter
coreutils
Need a rebuild with
--with-selinux
flag to link with libselinux
cronie
Need a rebuild with
--with-selinux
flag
dbus
Need a rebuild with
--enable-libaudit
and
--enable-selinux
flags
findutils
Need a rebuild with libselinux installed to enable SELinux-specific options
iproute2
Need a rebuild with
--with-selinux
flag
logrotate
Need a rebuild with
--with-selinux
flag
openssh
Need a rebuild with
--with-selinux
flag
pam
Need a rebuild with
--enable-selinux
flag for Linux-PAM ; Need a patch for pam_unix2, which only removes a function already implemented in a recent versions of libselinux
pambase
Configuration changes to add pam_selinux.so to
/etc/pam.d/system-login
psmisc
Need a rebuild with
--with-selinux
flag
shadow
Need a rebuild with
--with-selinux
flags
sudo
Need a rebuild with
--with-selinux
flag
systemd
Need a rebuild with
--enable-audit
and
--enable-selinux
flags
util-linux
Need a rebuild with
--with-selinux
flag
uutils-coreutils
Need a rebuild with
USE=selinux
make flag to link with libselinux
All of the other SELinux-related packages may be included without changes nor risks.
Concepts: Mandatory Access Controls
Note
This section is meant for beginners. If you know what SELinux does and how it works, feel free to skip ahead to the installation.
Before you enable SELinux, it is worth understanding what it does. Simply and succinctly, SELinux enforces
Mandatory Access Controls (MACs)
on Linux. In contrast to SELinux, the traditional user/group/rwx permissions are a form of
Discretionary Access Control (DAC)
. MACs are different from DACs because security policy and its execution are completely separated.
An example would be the use of the
sudo
command. When DACs are enforced, sudo allows temporary privilege escalation to root, giving the process so spawned unrestricted systemwide access. However, when using MACs, if the security administrator deems the process to have access only to a certain set of files, then no matter what the kind of privilege escalation used, unless the security policy itself is changed, the process will remain constrained to simply that set of files. So if
sudo
is tried on a machine with SELinux running in order for a process to gain access to files its policy does not allow, it will fail.
Another set of examples are the traditional (-rwxr-xr-x) type permissions given to files. When under DAC, these are user-modifiable. However, under MAC, a security administrator can choose to freeze the permissions of a certain file by which it would become impossible for any user to change these permissions until the policy regarding that file is changed.
As you may imagine, this is particularly useful for processes which have the potential to be compromised, i.e. web servers and the like. If DACs are used, then there is a particularly good chance of havoc being wreaked by a compromised program which has access to privilege escalation.
For further information, visit
Wikipedia:Mandatory access control
.
Installing SELinux
Package description
All SELinux related packages belong to the
selinux
group in the AUR. Before you manually install any of these, read
#Installation
to see recommended options for a comprehensive installation.
SELinux aware system utilities
coreutils-selinux
AUR
Modified coreutils package compiled with SELinux support enabled. It replaces the
coreutils
package.
cronie-selinux
AUR
Fedora fork of Vixie cron with SELinux enabled. It replaces the
cronie
package.
dbus-selinux
AUR
An SELinux aware version of
D-Bus
. It replaces the
dbus
package.
findutils-selinux
AUR
Patched findutils package compiled with SELinux support to make searching of files with specified security context possible. It replaces the
findutils
package.
iproute2-selinux
AUR
iproute2 package compiled with SELinux support; for example, it adds the
-Z
option to
ss
. It replaces the
iproute2
package.
logrotate-selinux
AUR
Logrotate package compiled with SELinux support. It replaces the
logrotate
package.
openssh-selinux
AUR
OpenSSH
package compiled with SELinux support to set security context for user sessions. It replaces the
openssh
package.
pam-selinux
AUR
and
pambase-selinux
AUR
PAM package with pam_selinux.so. and the underlying base package. They replace the
pam
and
pambase
packages respectively.
psmisc-selinux
AUR
Psmisc package compiled with SELinux support; for example, it adds the
-Z
option to
killall
. It replaces the
psmisc
package.
shadow-selinux
AUR
Shadow package compiled with SELinux support; contains a modified
/etc/pam.d/login
file to set correct security context for user after login. It replaces the
shadow
package.
sudo-selinux
AUR
Modified
sudo
package compiled with SELinux support which sets the security context correctly. It replaces the
sudo
package.
systemd-selinux
AUR
An SELinux aware version of
systemd
. It replaces the
systemd
package.
util-linux-selinux
AUR
Modified util-linux package compiled with SELinux support enabled. It replaces the
util-linux
package.
SELinux userspace utilities
checkpolicy
AUR
Tools to build SELinux policy
mcstrans
AUR
Daemon which is used by libselinux to translate MCS labels
libselinux
AUR
Library for security-aware applications. Python bindings needed for
semanage
and
setools
now included.
libsemanage
AUR
Library for policy management. Python bindings needed for
semanage
and
setools
now included.
libsepol
AUR
Library for binary policy manipulation.
policycoreutils
AUR
SELinux core utils such as newrole, setfiles, etc.
restorecond
AUR
Daemon which maintains the label of some files
secilc
AUR
Compiler for SELinux policies written in CIL (Common Intermediate Language)
selinux-dbus-config
AUR
DBus service which allows managing SELinux configuration
selinux-gui
AUR
SELinux GUI tools (system-config-selinux)
selinux-python
AUR
SELinux python tools and libraries (semanage, sepolgen, sepolicy, etc.)
selinux-sandbox
AUR
Sandboxing tool for SELinux
semodule-utils
AUR
Tools to handle SELinux modules when building a policy
SELinux policy packages
This article or section needs expansion.
Reason:
It is unclear which packages are alternatives (Discuss in
Talk:SELinux#Refpolicy instructions are unclear / out-of-date
)
selinux-refpolicy-src
AUR
Reference policy sources
selinux-refpolicy-git
AUR
Reference policy git master (
https://github.com/SELinuxProject/refpolicy
) built with configuration specific for Arch Linux
selinux-refpolicy-arch
AUR
Precompiled modular Reference policy with headers and documentation but without sources. Development Arch Linux Refpolicy patches included, which fixes issues related to path labeling and systemd support. These patches are also sent to Reference Policy maintainers and their inclusion in
selinux-refpolicy-arch
AUR
is mainly a way to perform updates between Refpolicy releases.
Other SELinux tools
setools
AUR
CLI and GUI tools to manage SELinux
selinux-alpm-hook
AUR
pacman hook to label files accordingly to SELinux policy when installing and updating packages
Installation
There are three methods to install the requisite SELinux packages.
Via binary package on GitHub
All packages are available from the
selinux
unofficial repository. the
base
package can be replaced with
base-selinux
during the
arch-bootstrap
stage of system installation.
Warning
Currently this repository does not provide signed packages, meaning that the binary it downloads will not be verified by pacman. This presents a security risk; proceed with caution.
Via build script from GitHub
This repository also contains a script named
build_and_install_all.sh
which builds and installs (or updates) all packages in the needed order. Here is an example of a way this script can be used in a user shell to install all packages (with downloading the GPG keys which are used to verify the source tarballs of the package):
$ git clone
https://github.com/archlinuxhardened/selinux.git
$ cd selinux
$ ./recv_gpg_keys.sh
$ ./build_and_install_all.sh
Of course, it is possible to modify the content of
build_and_install_all.sh
before running it, for example if you already have SELinux support in your kernel.
Via AUR
First, install SELinux userspace tools and libraries, in this order (because of the dependencies):
libsepol
AUR
,
libselinux
AUR
,
checkpolicy
AUR
,
secilc
AUR
,
setools
AUR
,
libsemanage
AUR
,
semodule-utils
AUR
,
policycoreutils
AUR
,
selinux-python
AUR
(which depends on
python-ipy
AUR
),
mcstrans
AUR
and
restorecond
AUR
.
Then install
pambase-selinux
AUR
and
pam-selinux
AUR
and make sure you can login again after the installation completed, because files in
/etc/pam.d/
got removed and created when
pambase
got replaced with
pambase-selinux
AUR
.
Next you can recompile some core packages by installing:
coreutils-selinux
AUR
,
findutils-selinux
AUR
,
iproute2-selinux
AUR
,
logrotate-selinux
AUR
,
openssh-selinux
AUR
,
psmisc-selinux
AUR
,
shadow-selinux
AUR
,
cronie-selinux
AUR
Next, backup your
/etc/sudoers
file if you are not using
its drop-in files
. Install
sudo-selinux
AUR
and restore your
/etc/sudoers
(it is overridden when this package is installed as a replacement of
sudo
).
Next come util-linux and systemd. Because of a cyclic makedepends between these two packages which will not be fixed (
FS#39767
), you need to build the source package
systemd-selinux
AUR
, install
systemd-libs-selinux
AUR
, build and install
util-linux-selinux
AUR
(with
util-linux-libs-selinux
AUR
) and rebuild and install
systemd-selinux
AUR
.
Next, install
dbus-selinux
AUR
.
Next, install
selinux-alpm-hook
AUR
in order to run restorecon every time pacman installs a package.
After all these steps, you can install a SELinux kernel (like
linux
) and a policy (like
selinux-refpolicy-arch
AUR
or
selinux-refpolicy-git
AUR
).
Enable SELinux LSM
To enable SELinux as default security model on every boot, set the following
kernel parameter
:
lsm=landlock,lockdown,yama,integrity,selinux,bpf
Note
The
lsm=
kernel parameter sets the initialization order of Linux security modules. The kernel's configured
lsm=
value can be found with
zgrep CONFIG_LSM= /proc/config.gz
and the current value with
cat /sys/kernel/security/lsm
.
Make sure that
selinux
is the first "major" module in the list.
[3]
Examples of valid values and their order can be found in
security/Kconfig
.
capability
should be omitted from
lsm=
as it will always get included automatically.
Custom kernel
When
compiling the kernel
, it is required to set at least the following options:
CONFIG_SECURITY_SELINUX=y
CONFIG_AUDIT=y
To enable the SELinux Linux security model by default and omit the need to set kernel parameters, additionally set the
CONFIG_LSM
option and specify
selinux
as the first "major" module in the list:
CONFIG_LSM="landlock,lockdown,yama,integrity,selinux,bpf"
Checking PAM
A correctly set-up
PAM
is important to get the proper security context after login. Check for the presence of the following lines in
/etc/pam.d/system-login
:
# pam_selinux.so close should be the first session rule
session         required        pam_selinux.so close
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session         required        pam_selinux.so open
Installing a policy
Warning
The reference policy as given by
SELinuxProject
is not very good for Arch Linux. Most people submitting patches to improve the policy use an other distribution (Debian, Gentoo, RHEL, etc.), therefore the compatibility with Arch Linux packages is not perfect (for example the policy may not support the most recent features of a program).
Policies are the mainstay of SELinux. They are what govern its behaviour. The only policy currently available in the AUR is the Reference Policy. In order to install it, you should use the source files, which may be got from the package
selinux-refpolicy-src
AUR
or by downloading the latest release on
https://github.com/SELinuxProject/refpolicy/wiki/DownloadRelease#current-release
. When using the AUR package, navigate to
/etc/selinux/refpolicy/src/policy
and run the following commands:
# make bare
# make conf
# make install
to install the reference policy as it is. Those who know how to write SELinux policies can tweak them to their heart's content before running the commands written above. The command takes a while to do its job and taxes one core of your system completely, so do not worry. Just sit back and let the command run for as long as it takes.
To load the reference policy run:
# make load
Then, make the file
/etc/selinux/config
with the following contents (Only works if you used the defaults as mentioned above. If you decided to change the name of the policy, you need to tweak the file):
/etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#                   Set this value once you know for sure that SELinux is configured the way you like it and that your system is ready for deployment
#       permissive - SELinux prints warnings instead of enforcing.
#                    Use this to customise your SELinux policies and booleans prior to deployment. Recommended during policy development.
#       disabled - No SELinux policy is loaded.
#                  This is not a recommended setting, for it may cause problems with file labelling
SELINUX=permissive
# SELINUXTYPE= takes the name of SELinux policy to
# be used. Current options are:
#       refpolicy (vanilla reference policy)
#       <custompolicy> - Substitute <custompolicy> with the name of any custom policy you choose to load
SELINUXTYPE=refpolicy
Now, you may reboot. After rebooting, run:
# restorecon -r /
to label your filesystem.
Now, make a file
requiredmod.te
with the contents:
requiredmod.te
module requiredmod 1.0;

require {
        type devpts_t;
        type kernel_t;
        type device_t;
        type var_run_t;
        type udev_t;
        type hugetlbfs_t;
        type udev_tbl_t;
        type tmpfs_t;
        class sock_file write;
        class unix_stream_socket { read write ioctl };
        class capability2 block_suspend;
        class dir { write add_name };
        class filesystem associate;
}

#============= devpts_t ==============
allow devpts_t device_t:filesystem associate;

#============= hugetlbfs_t ==============
allow hugetlbfs_t device_t:filesystem associate;

#============= kernel_t ==============
allow kernel_t self:capability2 block_suspend;

#============= tmpfs_t ==============
allow tmpfs_t device_t:filesystem associate;

#============= udev_t ==============
allow udev_t kernel_t:unix_stream_socket { read write ioctl };
allow udev_t udev_tbl_t:dir { write add_name };
allow udev_t var_run_t:sock_file write;
and run the following commands:
# checkmodule -m -o requiredmod.mod requiredmod.te
# semodule_package -o requiredmod.pp -m requiredmod.mod
# semodule -i requiredmod.pp
This is required to remove a few messages from
/var/log/audit/audit.log
which are a nuisance to deal with in the reference policy. This is an ugly hack and it should be made very clear that the policy so installed simply patches the reference policy in order to hide the effects of incorrect labelling.
Testing in a Vagrant virtual machine
It is possible to use
Vagrant
to provision a virtual Arch Linux machine with SELinux configured. This is a convenient way to test an Arch Linux system running SELinux without modifying a current system. Here are commands which can be used to achieve this:
$ git clone
https://github.com/archlinuxhardened/selinux.git
$ cd selinux/_vagrant
$ vagrant up
$ vagrant ssh
Post-installation steps
You can check that SELinux is working with
sestatus
. You should get something like:
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             refpolicy
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              disabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28
To maintain correct context, you can
enable
restorecond.service
.
To switch to enforcing mode without rebooting, you can use:
# echo 1 > /sys/fs/selinux/enforce
Swapfiles
If you have a swap file instead of a swap partition, issue the following commands in order to set the appropriate security context:
# semanage fcontext -a -t swapfile_t "
/path/to/swapfile
"
# restorecon
/path/to/swapfile
Working with SELinux
SELinux defines security using a different mechanism than traditional Unix access controls. The best way to understand it is by example. For example, the SELinux security context of the apache homepage looks like the following:
$ ls -lZ /var/www/html/index.html
-rw-r--r--  username username system_u:object_r:httpd_sys_content_t /var/www/html/index.html
The first three and the last columns should be familiar to any (Arch) Linux user. The fourth column is new and has the format:
user:role:type[:level]
To explain:
User:
The SELinux user identity. This can be associated to one or more roles that the SELinux user is allowed to use.
Role:
The SELinux role. This can be associated to one or more types the SELinux user is allowed to access.
Type:
When a type is associated with a process, it defines what processes (or domains) the SELinux user (the subject) can access. When a type is associated with an object, it defines what access permissions the SELinux user has to that object.
Level:
This optional field can also be know as a range and is only present if the policy supports MCS or MLS.
This is important in case you wish to understand how to build your own policies, for these are the basic building blocks of SELinux. However, for most purposes, there is no need to, for the reference policy is sufficiently mature. However, if you are a power user or someone with very specific needs, then it might be ideal for you to learn how to make your own SELinux policies.
This
is a great series of articles for someone seeking to understand how to work with SELinux.
Troubleshooting
The place to look for SELinux errors is the
systemd journal
. In order to see SELinux messages related to the label
system_u:system_r:policykit_t:s0
(for example), you would need to run:
# journalctl _SELINUX_CONTEXT=system_u:system_r:policykit_t:s0
Useful tools
There are some tools/commands that can greatly help with SELinux.
restorecon
Restores the context of a file/directory (or recursively with
-R
) based on any policy rules
chcon
Change the context on a specific file
Reporting issues
Please report issues on GitHub:
https://github.com/archlinuxhardened/selinux/issues
See also
Security Enhanced Linux
Gentoo:SELinux
Fedora:SELinux
NSA's Official SELinux Homepage
SELinux Project Homepage
Reference Policy Homepage
SETools Homepage
ArchLinux, SELinux and You (archived)