About Security-Enhanced Linux (SELinux)
By Jithin on December 13th, 2016
Security Enhanced Linux ( SELinux ) is an additional layer of system security. The primary goal of SELINUX is to protect user data from system services that have been compromised. Most Linux administrators are familiar with the standard user/group/other permission security model. This is a user and group-based model known as discretionary access control. SELINUX provides an additional layer of security that is object-based and controlled by more sophisticated rules, known as mandatory access control. To allow remote anonymous access to a web server, firewall ports must be opened. However, this gives people an opportunity to crack the system, and if they compromise the web server process, gain its permissions: the permissions of the apache user and the apache group. That user/group has read access to things like the document root (/var/www/html), as well as write access to /tmp, /var/tmp, and any other files/directories that are world-writable.
SELinuxis a concept of security rules that determine which process can access which files, directories, and ports. Every file, process, directory, and port have a special security level called a SELINUX context. A context is a name that is used by the SELINUX policy to determine whether a process can access a file, directory, or port. By default, the policy does not allow any interaction unless an explicit rule grants access. If there is no allow rule, no access is allowed. SELinux labels have several contexts: user, role, type, and sensitivity. The targeted policy, which is the default policy enabled in REDHAT Enterprise Linux, bases its rules on the third context: the type context. Type context names usually end with ‘_t’. The type context of the web server is httpd_t. The type context for files and directories normally found in /var/www/html is httpd_sys_content_t. The type contexts for files and directories normally found in /tmp and /var /tmp is tmp_t. The type context for web server ports is http_port_t. There is a policy rule that permits apache to access files and directories with a context normally found in /var/www/html and other web server directories (httpd_sys_content_t). There is no allow rule in the policy for files normally found in /tmp and /var /tmp, so access is not permitted. With SELINUX, a malicious user could not access the /tmp directory. SELinux has rules for remote file systems such as NFS and CIFS, although all files on these file systems are labeled with the same context.
For troubleshooting purposes, SELinux protection can be temporarily disabled using SELinux modes. SELinux can be in any of three possible modes:
In enforcing mode, SELinux actively denies access to the web server attempting to read files with tmp_t type context. In enforcing mode, SELinux both logs and protects.
Permissive mode is often used to troubleshoot issues. In permissive mode, SELinux allows all interactions, even if there is no explicit rule, and it logs those interactions it would have denied in enforcing mode. This mode can be used to temporarily allow access to content that SELinux is restricted, no reboot is required to go from enforcing to permissions or back again.
A third mode, disabled completely disables SELinux. A system reboot is required to disable SELinux entirely, or to get from enforcing or permissive mode.
You can open the SELinux configuration file with your favorite text editor.
The configuration file is: /etc/selinux/config. For example:
# vi /etc/selinux/config
The output will look something like this:
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
# SELINUXTYPE= can take one of these two values:
# targeted – Targeted processes are protected,
# minimum – Modification of targeted policy. Only selected processes are protected.
# mls – Multi Level Security protection.
And we can check the current SELinux mode with executing “getenforce” command
SELinux Booleans are switches that change the behavior of the SELinux policy. SELinux Booleans are rules that can be enabled or disabled. They can be used by security administrators to tune the policy to make selective adjustments. The getsebool command is used to display SELinux Booleans and their current value. The -an option causes this command to list all of the plans.
If you need any further assistance please contact our support department.