Using SELinux Red Hat Enterprise Linux 9 Prevent users and processes from performing unauthorized interactions with files and devices by using Security-Enhanced Linux (SELinux) Red Hat Customer Content Services

Commands:
getenforce Enforcing
setenforce 0 getenforce Permissive
setenforce 1 getenforce Enforcing
semanage permissive -a httpd_t
USD sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31
vi /etc/selinux/config
This file controls the state of SELinux on the system. SELINUX= can take one of these three values: enforcing - SELinux security policy is enforced. permissive - SELinux prints warnings instead of enforcing. disabled - No SELinux policy is loaded. SELINUX= permissive SELINUXTYPE= can take one of these two values: targeted - Targeted processes are protected, mls - Multi Level Security protection. SELINUXTYPE=targeted
reboot
getenforce Permissive
vi /etc/selinux/config
This file controls the state of SELinux on the system. SELINUX= can take one of these three values: enforcing - SELinux security policy is enforced. permissive - SELinux prints warnings instead of enforcing. disabled - No SELinux policy is loaded. SELINUX= enforcing SELINUXTYPE= can take one of these two values: targeted - Targeted processes are protected, mls - Multi Level Security protection. SELINUXTYPE=targeted
reboot
getenforce Enforcing
ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts today
grep "SELinux is preventing" /var/log/messages
dmesg | grep -i -e type=1300 -e type=1400
reboot
fixfiles -F onboot
getenforce Enforcing
rpm -q grubby grubby- <version>
sudo grubby --update-kernel ALL --args selinux=0
reboot
getenforce Disabled
touch /.autorelabel reboot
dnf install kernel-doc less /usr/share/doc/kernel-doc- 4.18.0 /Documentation/admin-guide/kernel-parameters.txt
user_u:user_r:user_t
# semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 *
default unconfined_u s0-s0:c0.c1023 *
seinfo -u Users: 8 guest_u root staff_u sysadm_u system_u unconfined_u user_u xguest_u
USD seinfo -r Roles: 14 auditadm_r dbadm_r guest_r logadm_r nx_server_r object_r secadm_r staff_r sysadm_r system_r unconfined_r user_r webadm_r xguest_r
semanage boolean -l SELinux boolean State Default Description ... xguest_connect_network (on , on) Allow xguest users to configure Network Manager and connect to apache ports xguest_exec_content (on , on) Allow xguest to exec content ...
SELinux boolean State Default Description guest_exec_content (on , on) Allow guest to exec content
SELinux boolean State Default Description xguest_connect_network (on , on) Allow xguest users to configure Network Manager and connect to apache ports xguest_exec_content (on , on) Allow xguest to exec content xguest_mount_media (on , on) Allow xguest users to mount removable media xguest_use_bluetooth (on , on) Allow xguest to use blue tooth devices
SELinux boolean State Default Description unprivuser_use_svirt (off , off) Allow unprivileged user to create and transition to svirt domains.
SELinux boolean State Default Description staff_exec_content (on , on) Allow staff to exec content staff_use_svirt (on , on) allow staff user to create and transition to svirt domains.
SELinux boolean State Default Description auditadm_exec_content (on , on) Allow auditadm to exec content
SELinux boolean State Default Description dbadm_exec_content (on , on) Allow dbadm to exec content dbadm_manage_user_files (off , off) Determine whether dbadm can manage generic user files. dbadm_read_user_files (off , off) Determine whether dbadm can read generic user files.
SELinux boolean State Default Description logadm_exec_content (on , on) Allow logadm to exec content
SELinux boolean State Default Description webadm_manage_user_files (off , off) Determine whether webadm can manage generic user files. webadm_read_user_files (off , off) Determine whether webadm can read generic user files.
SELinux boolean State Default Description secadm_exec_content (on , on) Allow secadm to exec content
setsebool -P ssh_sysadm_login on
SELinux boolean State Default Description ssh_sysadm_login (on , on) Allow ssh logins as sysadm_r:sysadm_t sysadm_exec_content (on , on) Allow sysadm to exec content xdm_sysadm_login (on , on) Allow the graphical login program to login directly as sysadm_r:sysadm_t
# useradd <example_user>
# passwd <example_user> Changing password for user <example_user> . New password: Retype new password: passwd: all authentication tokens updated successfully.
id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# useradd -Z staff_u <example_user>
# passwd <example_user> Changing password for user <example_user> . New password: Retype new password: passwd: all authentication tokens updated successfully.
id -Z uid=1000( <example_user> ) gid=1000( <example_user> ) groups=1000( <example_user> ) context=staff_u:staff_r:staff_t:s0-s0:c0.c1023
semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 *
semanage login -m -s user_u -r s0 __default__
semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ user_u s0 * root unconfined_u s0-s0:c0.c1023 *
adduser <example_user>
passwd <example_user>
[ <example_user> @localhost ~]USD id -Z user_u:user_r:user_t:s0
[ <example_user> @localhost ~]USD ps axZ LABEL PID TTY STAT TIME COMMAND - 1 ? Ss 0:05 /usr/lib/systemd/systemd --switched-root --system --deserialize 18 - 3729 ? S 0:00 (sd-pam) user_u:user_r:user_t:s0 3907 ? Ss 0:00 /usr/lib/systemd/systemd --user - 3911 ? S 0:00 (sd-pam) user_u:user_r:user_t:s0 3918 ? S 0:00 sshd: <example_user> @pts/0 user_u:user_r:user_t:s0 3922 pts/0 Ss 0:00 -bash user_u:user_r:user_dbusd_t:s0 3969 ? Ssl 0:00 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only user_u:user_r:user_t:s0 3971 pts/0 R+ 0:00 ps axZ
setsebool -P ssh_sysadm_login on
adduser -G wheel -Z sysadm_u <example_user>
usermod -G wheel -Z sysadm_u <example_user>
restorecon -R -F -v /home/ <example_user>
semanage login -l | grep <example_user> <example_user> sysadm_u s0-s0:c0.c1023 *
[ <example_user> @localhost ~]USD id -Z sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
sudo -i [sudo] password for <example_user> :
id -Z sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
systemctl restart sshd
Failed to restart sshd.service: Access denied See system logs and 'systemctl status sshd.service' for details.
adduser -G wheel -Z staff_u <example_user>
usermod -G wheel -Z staff_u <example_user>
restorecon -R -F -v /home/ <example_user>
visudo -f /etc/sudoers.d/ <example_user>
<example_user> ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
semanage login -l | grep <example_user> <example_user> staff_u s0-s0:c0.c1023 *
[ <example_user> @localhost ~]USD sudo -i [sudo] password for <example_user> :
id -Z staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
systemctl restart sshd
Failed to restart sshd.service: Access denied See system logs and 'systemctl status sshd.service' for details.
systemctl start httpd systemctl status httpd ... httpd[14523]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:3131 ... systemd[1]: Failed to start The Apache HTTP Server. ...
semanage port -l | grep http http_cache_port_t tcp 8080, 8118, 8123, 10001-10010 http_cache_port_t udp 3130 http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989
semanage port -a -t http_port_t -p tcp 3131
systemctl start httpd
wget localhost:3131/index.html ... HTTP request sent, awaiting response... 403 Forbidden ...
sealert -l "*" SELinux is preventing httpd from getattr access on the file /var/test_www/html/index.html. ...
matchpathcon /var/www/html /var/test_www/html /var/www/html system_u:object_r:httpd_sys_content_t:s0 /var/test_www/html system_u:object_r:var_t:s0
semanage fcontext -a -e /var/www /var/test_www
restorecon -Rv /var/ Relabeled /var/test_www/html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0 Relabeled /var/test_www/html/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
systemctl status httpd ... Active: active (running) ... systemd[1]: Started The Apache HTTP Server. httpd[14888]: Server configured, listening on: port 3131 ...
wget localhost:3131/index.html ... HTTP request sent, awaiting response... 200 OK Length: 0 [text/html] Saving to: 'index.html' ...
semanage boolean -l | grep 'nfs\|cifs' | grep httpd httpd_use_cifs (off , off) Allow httpd to access cifs file systems httpd_use_nfs (off , off) Allow httpd to access nfs file systems
getsebool -a | grep 'nfs\|cifs' | grep httpd httpd_use_cifs --> off httpd_use_nfs --> off
setsebool httpd_use_nfs on setsebool httpd_use_cifs on
getsebool -a | grep 'nfs\|cifs' | grep httpd httpd_use_cifs --> on httpd_use_nfs --> on
man -k selinux | grep samba samba_net_selinux (8) - Security Enhanced Linux Policy for the samba_net processes samba_selinux (8) - Security Enhanced Linux Policy for the smbd processes ...
semanage fcontext -l | grep samba ... /var/cache/samba(/.*)? all files system_u:object_r:samba_var_t:s0 ... /var/spool/samba(/.*)? all files system_u:object_r:samba_spool_t:s0 ...
sesearch -A | grep samba | grep httpd ... allow httpd_t cifs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True ...
getsebool -a | grep homedirs git_cgi_enable_homedirs --> off git_system_enable_homedirs --> off httpd_enable_homedirs --> off mock_enable_homedirs --> off mpd_enable_homedirs --> off openvpn_enable_homedirs --> on ssh_chroot_rw_homedirs --> off
sesearch -A | grep httpd_enable_homedirs ... allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_nfs_home_dirs && httpd_enable_homedirs ]:True allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True ...
sesearch -A -s httpd_t -c file -p read ... allow httpd_t httpd_t:file { append getattr ioctl lock open read write }; allow httpd_t httpd_tmp_t:file { append create getattr ioctl link lock map open read rename setattr unlink write }; ...
man user_selinux
seinfo -x -a user_home_type Type Attributes: 1 attribute user_home_type; ... chrome_sandbox_home_t config_home_t cvs_home_t data_home_t dbus_home_t fetchmail_home_t gconf_home_t git_user_content_t ...
semanage fcontext -l | grep data_home_t ... /root/\.local/share(/.*)? all files system_u:object_r:data_home_t:s0 ...
semanage fcontext -a -t data_home_t '/shared-data(/.*)?'
semanage fcontext -l | grep "shared-data" /shared-data(/.*)? all files system_u:object_r:data_home_t:s0
ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent
journalctl -t setroubleshoot
dmesg | grep -i -e type=1300 -e type=1400
semodule -DB
semodule -B
setenforce 0 getenforce Permissive
sealert -l "*" SELinux is preventing /usr/bin/passwd from write access on the file /root/test. ***** Plugin leaks (86.2 confidence) suggests ***************************** If you want to ignore passwd trying to write access the test file, because you believe it should not need this access. Then you should report this as a bug. You can generate a local policy module to dontaudit this access. Do ausearch -x /usr/bin/passwd --raw | audit2allow -D -M my-passwd semodule -X 300 -i my-passwd.pp ***** Plugin catchall (14.7 confidence) suggests ************************** Raw Audit Messages type=AVC msg=audit(1553609555.619:127): avc: denied { write } for pid=4097 comm="passwd" path="/root/test" dev="dm-0" ino=17142697 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0 Hash: passwd,passwd_t,admin_home_t,file,write
auditctl -w /etc/shadow -p w -k shadow-write
rm -f /var/lib/setroubleshoot/setroubleshoot.xml
auditctl -W /etc/shadow -p w -k shadow-write
semanage fcontext -a -t httpd_sys_content_t "/srv/myweb(/.*)?"
restorecon -R -v /srv/myweb
USD matchpathcon -V /var/www/html/* /var/www/html/index.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0 /var/www/html/page1.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0
# restorecon -v /var/www/html/index.html restorecon reset /var/www/html/index.html context unconfined_u:object_r:user_home_t:s0->system_u:object_r:httpd_sys_content_t:s0
# restorecon -R -v /var/www/html/ restorecon reset /var/www/html/page1.html context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0 restorecon reset /var/www/html/index.html context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0
# setsebool -P httpd_can_network_connect_db on
USD getsebool -a | grep ftp ftpd_anon_write --> off ftpd_full_access --> off ftpd_use_cifs --> off ftpd_use_nfs --> off ftpd_connect_db --> off httpd_enable_ftp_server --> off tftp_anon_write --> off
# semanage port -l | grep http http_cache_port_t tcp 3128, 8080, 8118 http_cache_port_t udp 3130 http_port_t tcp 80, 443, 488, 8008, 8009, 8443 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989
# systemctl start httpd.service Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. # systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: failed (Result: exit-code) since Thu 2013-08-15 09:57:05 CEST; 59s ago Process: 16874 ExecStop=/usr/sbin/httpd USDOPTIONS -k graceful-stop (code=exited, status=0/SUCCESS) Process: 16870 ExecStart=/usr/sbin/httpd USDOPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
type=AVC msg=audit(1225948455.061:294): avc: denied { name_bind } for pid=4997 comm="httpd" src=9876 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket
# semanage port -a -t http_port_t -p tcp 9876
vim <local_module> .cil
(allow cupsd_lpd_t cupsd_var_run_t (sock_file (read)))
module local_cupslpd-read-cupssock 1.0; require { type cupsd_var_run_t; type cupsd_lpd_t; class sock_file read; } #============= cupsd_lpd_t ============== allow cupsd_lpd_t cupsd_var_run_t:sock_file read;
semodule -i <local_module> .cil
systemctl restart <service-name>
semodule -lfull | grep "local_" 400 local_module cil
sesearch -A --source= <SOURCENAME> --target= <TARGETNAME> --class= <CLASSNAME> --perm= <P1> , <P2>
sesearch -A --source=cupsd_lpd_t --target=cupsd_var_run_t --class=sock_file --perm=read allow cupsd_lpd_t cupsd_var_run_t:sock_file { append getattr open read write };
systemctl status <service-name>
ps -efZ | grep <process-name>
ausearch -m AVC -i -ts recent <no matches>
ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR
type=AVC msg=audit(1395177286.929:1638): avc: denied { read } for pid=6591 comm="httpd" name="webpages" dev="0:37" ino=2112 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=AVC msg=audit(1226874073.147:96): avc: denied { getattr } for pid=2465 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
user_u:user_r:user_t:s1
dnf install selinux-policy-mls
vi /etc/selinux/config
SELINUX=permissive SELINUXTYPE=mls
fixfiles -F onboot System will relabel on next boot
reboot
ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i
SELINUX=enforcing
reboot
getenforce Enforcing
sestatus | grep mls Loaded policy name: mls
setenforce 0
semanage user -m -L s1 -r s1-s15 staff_u
genhomedircon
restorecon -R -F -v /home/ Relabeled /home/staff from staff_u:object_r:user_home_dir_t:s0 to staff_u:object_r:user_home_dir_t:s1 Relabeled /home/staff/.bash_logout from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1 Relabeled /home/staff/.bash_profile from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1 Relabeled /home/staff/.bashrc from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1
semanage login -m -r s1 example_user
chcon -R -l s1 /home/ example_user
setenforce 1
semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ user_u s0-s0 * example_user user_u s1 * ...
id -Z user_u:user_r:user_t: s0-s2
id -Z user_u:user_r:user_t: s1-s2
newrole -l s1
id -Z user_u:user_r:user_t: s1-s2
exit
id -Z user_u:user_r:user_t: s0-s2
newrole -l s1-s2
id -Z user_u:user_r:user_t: s1-s2
ls -Z /path/to/file user_u:object_r:user_home_t: s0 /path/to/file
touch /path/to/file
exit
ls -Z /path/to/file user_u:object_r:user_home_t: s1 /path/to/file
ls -lZ /path/to/file -rw-r-----. 1 User1 User1 user_u:object_r:user_home_t: s1 0 12. Feb 10:43 /path/to/file
semanage fcontext -a -r s2 /path/to/file
restorecon -F -v /path/to/file Relabeled /path/to/file from user_u:object_r:user_home_t: s1 to user_u:object_r:user_home_t:s2
ls -lZ /path/to/file -rw-r-----. 1 User1 User1 user_u:object_r:user_home_t: s2 0 12. Feb 10:53 /path/to/file
cat /path/to/file cat: file: Permission denied
visudo -f /etc/sudoers.d/ <sec_adm_user>
<sec_adm_user> ALL=(ALL) TYPE=secadm_t ROLE=secadm_r ALL
id uid=1000( <sec_adm_user> ) gid=1000( <sec_adm_user> ) groups=1000( <sec_adm_user> ) context=staff_u:staff_r:staff_t:s0-s15:c0.c1023
sudo -i [sudo] password for <sec_adm_user> :
id uid=0(root) gid=0(root) groups=0(root) context=staff_u:secadm_r:secadm_t:s0-s15:c0.c1023
semodule -d sysadm_secadm
seinfo -xt secadm_t Types: 1 type secadm_t, can_relabelto_shadow_passwords, (...) userdomain;
logout
logout Connection to localhost closed.
id uid=0(root) gid=0(root) groups=0(root) context=root:sysadm_r:sysadm_t:s0-s15:c0.c1023
semodule -e sysadm_secadm SELinux: Could not load policy file /etc/selinux/mls/policy/policy.31: Permission denied /sbin/load_policy: Can't load policy: Permission denied libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory). SELinux: Could not load policy file /etc/selinux/mls/policy/policy.31: Permission denied /sbin/load_policy: Can't load policy: Permission denied libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory). semodule: Failed!
seinfo -xt sysadm_t [Errno 13] Permission denied: '/sys/fs/selinux/policy'
console_device_t sysadm_tty_device_t user_tty_device_t staff_tty_device_t auditadm_tty_device_t secureadm_tty_device_t
ls -Z `tty` root:object_r: user_devpts_t :s0 /dev/pts/0
setenforce 1
setenforce 0
(typeattributeset mlsfilewrite (_staff_t_))
semodule -i ~/ local_mlsfilewrite .cil
setenforce 1
semodule -lfull | grep "local_mls" 400 local_mlsfilewrite cil
user_u:user_r:user_t:s1:c2
vim local_mcs_user.cil
(typeattributeset mcs_constrained_type (user_t))
semodule -i local_mcs_user.cil
seinfo -xt user_t Types: 1 type user_t, application_domain_type, nsswitch_domain, corenet_unlabeled_type, domain, kernel_system_state_reader, mcs_constrained_type , netlabel_peer_type, privfd, process_user_target, scsi_generic_read, scsi_generic_write, syslog_client_type, pcmcia_typeattr_1, user_usertype, login_userdomain, userdomain, unpriv_userdomain, userdom_home_reader_type, userdom_filetrans_type, xdmhomewriter, x_userdomain, x_domain, dridomain, xdrawable_type, xcolormap_type;
vi /etc/selinux/targeted/setrans.conf
s0:c0=Marketing s0:c1=Finance s0:c2=Payroll s0:c3=Personnel
systemctl restart mcstrans
chcat -L
s0:c0 Marketing s0:c1 Finance s0:c2 Payroll s0:c3 Personnel s0 s0-s0:c0.c1023 SystemLow-SystemHigh s0:c0.c1023 SystemHigh
semanage user -m -rs0:c0,c1-s0:c0.c9 <user_u>
semanage login -m -rs0:c1 <Linux.user1>
chcat -l -- + <category1> ,- <category2> <Linux.user1> , <Linux.user2>
chcat -L -l <Linux.user1> , <Linux.user2> <Linux.user1> : <category1> , <category2> <Linux.user2> : <category1> , <category2>
chcat -- + <category1> ,+ <category2> <path/to/file1>
chcat -- - <category1> ,- <category2> <path/to/file1>
ls -lZ <path/to/file> -rw-r--r-- <LinuxUser1> <Group1> root:object_r:user_home_t:_<sensitivity>_:_<category>_ <path/to/file>
cat <path/to/file> cat: <path/to/file> : Permission Denied
ALLOW apache_process apache_log:FILE READ;
ls -Z /etc/passwd system_u:object_r:passwd_file_t:s0 /etc/passwd
vi mydaemon.c
#include <unistd.h> #include <stdio.h> FILE *f; int main(void) { while(1) { f = fopen("/var/log/messages","w"); sleep(5); fclose(f); } }
gcc -o mydaemon mydaemon.c
vi mydaemon.service [Unit] Description=Simple testing daemon [Service] Type=simple ExecStart=/usr/local/bin/mydaemon [Install] WantedBy=multi-user.target
cp mydaemon /usr/local/bin/ cp mydaemon.service /usr/lib/systemd/system systemctl start mydaemon systemctl status mydaemon ● mydaemon.service - Simple testing daemon Loaded: loaded (/usr/lib/systemd/system/mydaemon.service; disabled; vendor preset: disabled) Active: active (running) since Sat 2020-05-23 16:56:01 CEST; 19s ago Main PID: 4117 (mydaemon) Tasks: 1 Memory: 148.0K CGroup: /system.slice/mydaemon.service └─4117 /usr/local/bin/mydaemon May 23 16:56:01 localhost.localdomain systemd[1]: Started Simple testing daemon.
ps -efZ | grep mydaemon system_u:system_r:unconfined_service_t:s0 root 4117 1 0 16:56 ? 00:00:00 /usr/local/bin/mydaemon
sepolicy generate --init /usr/local/bin/mydaemon Created the following files: /home/example.user/mysepol/mydaemon.te # Type Enforcement file /home/example.user/mysepol/mydaemon.if # Interface file /home/example.user/mysepol/mydaemon.fc # File Contexts file /home/example.user/mysepol/mydaemon_selinux.spec # Spec file /home/example.user/mysepol/mydaemon.sh # Setup Script
./mydaemon.sh Building and Loading Policy + make -f /usr/share/selinux/devel/Makefile mydaemon.pp Compiling targeted mydaemon module Creating targeted mydaemon.pp policy package rm tmp/mydaemon.mod.fc tmp/mydaemon.mod + /usr/sbin/semodule -i mydaemon.pp
restorecon -v /usr/local/bin/mydaemon /usr/lib/systemd/system
systemctl restart mydaemon ps -efZ | grep mydaemon system_u:system_r:mydaemon_t:s0 root 8150 1 0 17:18 ? 00:00:00 /usr/local/bin/mydaemon
ausearch -m AVC -ts recent type=AVC msg=audit(1590247112.719:5935): avc: denied { open } for pid=8150 comm="mydaemon" path="/var/log/messages" dev="dm-0" ino=2430831 scontext=system_u:system_r:mydaemon_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file permissive=1
sealert -l "*" SELinux is preventing mydaemon from open access on the file /var/log/messages. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that mydaemon should be allowed open access on the messages file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: ausearch -c 'mydaemon' --raw | audit2allow -M my-mydaemon semodule -X 300 -i my-mydaemon.pp Additional Information: Source Context system_u:system_r:mydaemon_t:s0 Target Context unconfined_u:object_r:var_log_t:s0 Target Objects /var/log/messages [ file ] Source mydaemon ...
ausearch -m AVC -ts recent | audit2allow -R require { type mydaemon_t; } #============= mydaemon_t ============== logging_write_generic_logs(mydaemon_t)
macro-expander "logging_write_generic_logs(mydaemon_t)" allow mydaemon_t var_t:dir { getattr search open }; allow mydaemon_t var_log_t:dir { getattr search open read lock ioctl }; allow mydaemon_t var_log_t:dir { getattr search open }; allow mydaemon_t var_log_t:file { open { getattr write append lock ioctl } }; allow mydaemon_t var_log_t:dir { getattr search open }; allow mydaemon_t var_log_t:lnk_file { getattr read };
echo "logging_write_generic_logs(mydaemon_t)" >> mydaemon.te
echo "allow mydaemon_t var_log_t:file { open write getattr };" >> mydaemon.te
./mydaemon.sh Building and Loading Policy + make -f /usr/share/selinux/devel/Makefile mydaemon.pp Compiling targeted mydaemon module Creating targeted mydaemon.pp policy package rm tmp/mydaemon.mod.fc tmp/mydaemon.mod + /usr/sbin/semodule -i mydaemon.pp
ps -efZ | grep mydaemon system_u:system_r:mydaemon_t:s0 root 8150 1 0 17:18 ? 00:00:00 /usr/local/bin/mydaemon
ausearch -m AVC -ts recent <no matches>
dnf install -y udica
dnf module install -y container-tools
podman run --env container=podman -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash
podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 37a3635afb8f registry.access.redhat.com/ubi8:latest bash 15 minutes ago Up 15 minutes ago heuristic_lewin
podman inspect 37a3635afb8f > container.json udica -j container.json my_container Policy my_container with container id 37a3635afb8f created! [...]
podman inspect 37a3635afb8f | udica my_container Policy my_container with container id 37a3635afb8f created! Please load these modules using: semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil} Restart the container with: "--security-opt label=type:my_container.process" parameter
semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}
podman stop 37a3635afb8f podman run --security-opt label=type: my_container .process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash
ps -efZ | grep my_container .process unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 2275 434 1 13:49 pts/1 00:00:00 podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash system_u:system_r:my_container.process:s0:c270,c963 root 2317 2305 0 13:49 pts/0 00:00:00 bash
cd /home ls username cd /var/spool/ touch test
dnf install nmap-ncat nc -lvp 21 ... Ncat: Listening on :::21 Ncat: Listening on 0.0.0.0:21 ^C nc -lvp 80 ... Ncat: bind to :::80: Permission denied. QUITTING.
cp /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml <my-selinux-playbook.yml> vi <my-selinux-playbook.yml>
selinux_modules: - { path: "selinux-local-1.pp", priority: "400" }
ansible-playbook <my-selinux-playbook.yml> --syntax-check
ansible-playbook <my-selinux-playbook.yml>
- name: Allow Apache to listen on tcp port <port_number> community.general.seport: ports: <port_number> proto: tcp setype: http_port_t state: present
--- - name: Modify SELinux port mapping example hosts: all vars: # Map tcp port <port_number> to the 'http_port_t' SELinux port type selinux_ports: - ports: <port_number> proto: tcp setype: http_port_t state: present tasks: - name: Include selinux role ansible.builtin.include_role: name: rhel-system-roles.selinux
semanage port --list | grep http_port_t http_port_t tcp <port_number> , 80, 81, 443, 488, 8008, 8009, 8443, 9000
semanage export -f ./ my-selinux-settings.mod
scp ./ my-selinux-settings.mod new-system-hostname :
ssh root@ new-system-hostname
new-system-hostname # semanage import -f ./ my-selinux-settings.mod
setsebool -P allow_polyinstantiation 1
mkdir /tmp-inst /var/tmp/tmp-inst --mode 000
restorecon -Fv /tmp-inst /var/tmp/tmp-inst Relabeled /tmp-inst from unconfined_u:object_r:default_t:s0 to system_u:object_r:tmp_t:s0 Relabeled /var/tmp/tmp-inst from unconfined_u:object_r:tmp_t:s0 to system_u:object_r:tmp_t:s0
allow_filesystem_mark = 1
/tmp /tmp-inst/ level root,adm /var/tmp /var/tmp/tmp-inst/ level root,adm USDHOME USDHOME/USDUSER.inst/ level
/tmp /tmp-inst/ user root,adm /var/tmp /var/tmp/tmp-inst/ user root,adm USDHOME USDHOME/USDUSER.inst/ user
grep namespace /etc/pam.d/login session required pam_namespace.so
AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat AuthorizedKeysCommandRunAs root
grep -r PubkeyAuthentication /etc/ssh/ /etc/ssh/sshd_config:#PubkeyAuthentication yes
[...] session include system-auth session required pam_namespace.so unmnt_remnt [...]
findmnt --mountpoint /tmp/ TARGET SOURCE FSTYPE OPTIONS /tmp /dev/vda1[/tmp-inst/ <user> ] xfs rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota