Book Image

SELinux Cookbook

By : Sven Vermeulen
Book Image

SELinux Cookbook

By: Sven Vermeulen

Overview of this book

Related Content you might be interested in

Current Title:

Small book image
SELinux Cookbook
Sven Vermeulen
Sep, 2014 | 240 pages
No titles found
Table of Contents (17 chapters)
SELinux Cookbook
SELinux Cookbook
Credits
Credits
About the Author
About the Author
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
The SELinux Development Environment
The SELinux Development Environment
Introduction
Creating the development environment
Building a simple SELinux module
Calling refpolicy interfaces
Creating our own interface
Using the refpolicy naming convention
Distributing SELinux policy modules
2
Dealing with File Labels
Dealing with File Labels
Introduction
Defining file contexts through patterns
Using substitution definitions
Enhancing an SELinux policy with file transitions
Setting resource-sensitivity labels
Configuring sensitivity categories
3
Confining Web Applications
Confining Web Applications
Introduction
Listing conditional policy support
Enabling user directory support
Assigning web content types
Using different web server ports
Using custom content types
Creating a custom CGI domain
Setting up mod_selinux
Starting Apache with limited clearance
Mapping HTTP users to contexts
Using source address mapping to decide on contexts
Separating virtual hosts with mod_selinux
4
Creating a Desktop Application Policy
Creating a Desktop Application Policy
Introduction
Researching the application's logical design
Creating a skeleton policy
Setting context definitions
Defining application role interfaces
Testing and enhancing the policy
Ignoring permissions we don't need
Creating application resource interfaces
Adding conditional policy rules
Adding build-time policy decisions
5
Creating a Server Policy
Creating a Server Policy
Introduction
Understanding the service
Choosing resource types wisely
Differentiating policies based on use cases
Creating resource-access interfaces
Creating exec, run, and transition interfaces
Creating a stream-connect interface
Creating the administrative interface
6
Setting Up Separate Roles
Setting Up Separate Roles
Introduction
Managing SELinux users
Mapping Linux users to SELinux users
Running commands in a specified role with sudo
Running commands in a specified role with runcon
Switching roles
Creating a new role
Initial role based on entry
Defining role transitions
Looking into access privileges
7
Choosing the Confinement Level
Choosing the Confinement Level
Introduction
Finding common resources
Defining common helper domains
Documenting common privileges
Granting privileges to all clients
Creating a generic application domain
Building application-specific domains using templates
Using fine-grained application domain definitions
8
Debugging SELinux
Debugging SELinux
Introduction
Identifying whether SELinux is to blame
Analyzing SELINUX_ERR messages
Logging positive policy decisions
Looking through SELinux constraints
Ensuring an SELinux rule is never allowed
Using strace to clarify permission issues
Using strace against daemons
Auditing system behavior
9
Aligning SELinux with DAC
Aligning SELinux with DAC
Introduction
Assigning a different root location to regular services
Using a different root location for SELinux-aware applications
Sharing user content with file ACLs
Enabling polyinstantiated directories
Configuring capabilities instead of setuid binaries
Using group membership for role-based access
Backing up and restoring files
Governing application network access
10
Handling SELinux-aware Applications
Handling SELinux-aware Applications
Introduction
Controlling D-Bus message flows
Restricting service ownership
Understanding udev's SELinux integration
Using cron with SELinux
Checking the SELinux state programmatically
Querying SELinux userland configuration in C
Interrogating the SELinux subsystem code-wise
Running new processes in a new context
Reading the context of a resource
Index
Index

About the Reviewers

David Quigley started his career as a computer systems researcher for the National Information Assurance Research Lab at the NSA, where he worked as a member of the SELinux team. He led the design and implementation to provide Labeled NFS support for SELinux. He has previously contributed to the open source community by maintaining the Unionfs 1.0 code base and through code contributions to various other projects. He has presented at conferences such as the Ottawa Linux Symposium, the StorageSS workshop, LinuxCon, and several local Linux User Group meetings, where presentation topics included storage, filesystems, and security. David currently works as a Computer Science Professional for the Operations, Analytics, and Software Development (OASD) division at KEYW Corporation, developing innovative system software for Unix and Windows platforms.

I would like to thank my wonderful wife, Kathy, for all she has done to make sure I have the time to do things such as review this book and travel to give presentations on SELinux. She is the joy of my life and has helped me become the man I am today. I'd also like to thank all my children—Zoe, Jane, and the twins—who remind us to love and cherish the time we have as a family. Also, I thank my parents, Gary and Vicky, for supporting my decisions to change my educational direction and become a computer scientist, allowing me to be where I am today.

Sam Wilson is a systems and security engineer with a focus on Red Hat Enterprise Linux. Having spent 2 years working as an information security consultant and also having passed the Red Hat SELinux Policy Administration exam, he is often asked for SELinux advice within teams he works with. Sam has been active in the GNU/Linux communities since early 2007 and has contributed to NTFreeNet, Darwin Community Arts, Ansible, and the Fedora project. Sam can be found online at www.cycloptivity.net.

Jason Zaman is a graduate from Carnegie Mellon University with a degree in Electrical and Computer Engineering. He has been interested in computers and open source and uses Linux from a young age. After using Gentoo Linux for many years, he has now joined the Gentoo Hardened and SELinux projects as a developer. Currently, he works in a start-up company mainly doing Android development and system administration to maintain the servers.

Lukáš Zapletal works as a software engineer in the cloud division of Red Hat, where he develops the Satellite 6.0 product and is also responsible for SELinux policies of the product. He is part of the Fedora, Foreman, Katello, and OpenStack communities. He worked as an Editor in Chief at Linux+ and cofounded the LinuxEXPRES (Czech) magazine.

Red Hat is the world's leading provider of open source solutions, using a community-powered approach to provide reliable and high-performing cloud, virtualization, storage, Linux, and middleware technologies.

I'd like to thank Mirek Grepl and Dan Walsh from the Red Hat SELinux team for all their answers, and my family, Broňa and Ondra, for allowing me to review this amazing book.

Previous Section
Next Chapter