49.2. Introduction to SELinux
49.2.1. SELinux Overview
When a subject, (for example, an application), attempts to access an object (for example, a file), the policy enforcement server in the kernel checks an access vector cache (AVC), where subject and object permissions are cached. If a decision cannot be made based on data in the AVC, the request continues to the security server, which looks up the security context of the application and the file in a matrix. Permission is then granted or denied, with an
avc: denied message detailed in
/var/log/messages if permission is denied. The security context of subjects and objects is applied from the installed policy, which also provides the information to populate the security server's matrix.
Figure 49.1. SELinux Decision Process
Instead of running in enforcing mode, SELinux can run in permissive mode, where the AVC is checked and denials are logged, but SELinux does not enforce the policy. This can be useful for troubleshooting and for developing or fine-tuning SELinux policy.
49.2.2. Files Related to SELinux
184.108.40.206. The SELinux Pseudo-File System
/selinux/pseudo-file system contains commands that are most commonly used by the kernel subsystem. This type of file system is similar to the
-rw-rw-rw- 1 root root 0 Sep 22 13:14 access dr-xr-xr-x 1 root root 0 Sep 22 13:14 booleans --w------- 1 root root 0 Sep 22 13:14 commit_pending_bools -rw-rw-rw- 1 root root 0 Sep 22 13:14 context -rw-rw-rw- 1 root root 0 Sep 22 13:14 create --w------- 1 root root 0 Sep 22 13:14 disable -rw-r--r-- 1 root root 0 Sep 22 13:14 enforce -rw------- 1 root root 0 Sep 22 13:14 load -r--r--r-- 1 root root 0 Sep 22 13:14 mls -r--r--r-- 1 root root 0 Sep 22 13:14 policyvers -rw-rw-rw- 1 root root 0 Sep 22 13:14 relabel -rw-rw-rw- 1 root root 0 Sep 22 13:14 user
catcommand on the
enforcefile reveals either a
1for enforcing mode or
0for permissive mode.
220.127.116.11. SELinux Configuration Files
/etc/sysconfig/selinux Configuration File
system-config-selinux), or manually editing the configuration file (
/etc/sysconfig/selinuxfile is the primary configuration file for enabling or disabling SELinux, as well as for setting which policy to enforce on the system and how to enforce it.
/etc/sysconfig/selinuxcontains a symbolic link to the actual configuration file,
SELINUX=enforcing|permissive|disabled— Defines the top-level state of SELinux on a system.
enforcing— The SELinux security policy is enforced.
permissive— The SELinux system prints warnings but does not enforce policy.This is useful for debugging and troubleshooting purposes. In permissive mode, more denials are logged because subjects can continue with actions that would otherwise be denied in enforcing mode. For example, traversing a directory tree in permissive mode produces
avc: deniedmessages for every directory level read. In enforcing mode, SELinux would have stopped the initial traversal and kept further denial messages from occurring.
disabled— SELinux is fully disabled. SELinux hooks are disengaged from the kernel and the pseudo-file system is unregistered.
NoteActions made while SELinux is disabled may result in the file system no longer having the correct security context. That is, the security context defined by the policy. The best way to relabel the file system is to create the flag file
/.autorelabeland reboot the machine. This causes the relabel to occur very early in the boot process, before any processes are running on the system. Using this procedure means that processes can not accidentally create files in the wrong context or start up in the wrong context.It is possible to use the
fixfiles relabelcommand prior to enabling SELinux to relabel the file system. This method is not recommended, however, because after it is complete, it is still possible to have processes potentially running on the system in the wrong context. These processes could create files that would also be in the wrong context.
NoteAdditional white space at the end of a configuration line or as extra lines at the end of the file may cause unexpected behavior. To be safe, remove unnecessary white space.
SELINUXTYPE=— Specifies which policy SELinux should enforce.
targeted— Only targeted network daemons are protected.
ImportantThe following daemons are protected in the default targeted policy:
dhcpd, httpd (apache.te), named, nscd, ntpd, portmap, snmpd, squid, and
syslogd. The rest of the system runs in the unconfined_t domain. This domain allows subjects and objects with that security context to operate using standard Linux security.The policy files for these daemons are located in
/etc/selinux/targeted/src/policy/domains/program. These files are subject to change as newer versions of Red Hat Enterprise Linux are released.Policy enforcement for these daemons can be turned on or off, using Boolean values controlled by the SELinux Administration Tool (
system-config-selinux).Setting a Boolean value for a targeted daemon to
1disables SELinux protection for the daemon. For example, you can set
init, which executes apps labeled
dhcpd_exec_t, from transitioning to the
getsebool -acommand to list all SELinux booleans. The following is an example of using the
setseboolcommand to set an SELinux boolean. The
-Poption makes the change permanent. Without this option, the boolean would be reset to
setsebool -P dhcpd_disable_trans=0
strict— Full SELinux protection, for all daemons. Security contexts are defined for all subjects and objects, and every action is processed by the policy enforcement server.
SETLOCALDEFS=— Controls how local definitions (users and booleans) are set. Set this value to 1 to have these definitions controlled by
load_policyfrom files in
/etc/selinux/<policyname>. or set it to 0 to have them controlled by
WarningYou should not change this value from the default (0) unless you are fully aware of the impact of such a change.
/etc/selinux/directory is the primary location for all policy files as well as the main configuration file.
-rw-r--r-- 1 root root 448 Sep 22 17:34 config drwxr-xr-x 5 root root 4096 Sep 22 17:27 strict drwxr-xr-x 5 root root 4096 Sep 22 17:28 targeted
targeted/, are the specific directories where the policy files of the same name (that is,
targeted) are contained.
18.104.22.168. SELinux Utilities
/usr/sbin/setenforce— Modifies in real-time the mode in which SELinux runs.For example:
setenforce 1— SELinux runs in enforcing mode.
setenforce 0— SELinux runs in permissive mode.To actually disable SELinux, you need to either specify the appropriate
/etc/sysconfig/selinuxor pass the parameter
selinux=0to the kernel, either in
/etc/grub.confor at boot time.
/usr/sbin/sestatus -v— Displays the detailed status of a system running SELinux. The following example shows an excerpt of
SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 21 Policy from config file: targeted Process contexts: Current context: user_u:system_r:unconfined_t:s0 Init context: system_u:system_r:init_t:s0 /sbin/mingetty system_u:system_r:getty_t:s0
/usr/bin/newrole— Runs a new shell in a new context, or role. Policy must allow the transition to the new role.
NoteThis command is only available if you have the
policycoreutils-newrolepackage installed, which is required for the strict and MLS policies.
/sbin/restorecon— Sets the security context of one or more files by marking the extended attributes with the appropriate file or security context.
/sbin/fixfiles— Checks or corrects the security context database on the file system.
policycoreutilspackage contents for more information on all available binary utilities. To view the contents of a package, use the following command:
rpm -ql <package-name>
49.2.3. Additional Resources
22.214.171.124. Installed Documentation
/usr/share/doc/setools-<version-number>/All documentation for utilities contained in the
setoolspackage. This includes all helper scripts, sample configuration files, and documentation.
126.96.36.199. Useful Websites
- http://www.nsa.gov/research/selinux/index.shtml Homepage for the NSA SELinux development team. Many resources are available in HTML and PDF formats. Although many of these links are not SELinux specific, some concepts may apply.
- http://docs.fedoraproject.org/ Homepage for the Fedora documentation project, which contains Fedora Core specific materials that may be more timely, since the release cycle is much shorter.
- http://selinux.sourceforge.net Homepage for the SELinux community.