Working With Security Enhanced Linux (SELinux)

Security Enhanced Linux (SELinux) is another layer of security for the Linux OS. Instead of turning it off, however, you could use SELinux in “permissive” mode, which allows everything to function normally but logs warnings when actions or commands would have been blocked. 

Let’s start with some of the basics to understanding SELinux. It can run in three different modes:

disabled         SELinux is turned off and doesn’t restrict anything

permissive SELinux is turned on, logs warnings only

enforcing SELinux is turned on and blocks actions related to services

View the current status of SELinux

You can change the mode in which SELinux operates by using setup command or changing the config file (/etc/selinux/config)

SELinux uses three different contexts to enforce security: user, role and domain (also called type). 

unconfined_u Unprotected user

system_u         System user

user_u Normal user

object_r File

system_r Users and processes

unconfined_t Unprotected file or process

Let’s take a look at SSH service as an example. 

The first field you see here is system_u, which is a system user. The second file contains system_r, which is a process. The third field shows unconfined_t as the domain.

Another example is ssh_config file:

You see the user is system_u (a system user), the role is object_r (a file), and the domain is etc_t. Any service that has access to the ect_t domain is able to access this file.

To change the context of a file or directory, you can use the chcon command:

Step 1. Change the user context from normal user to system user:

Step 2. Reset the context of your file back to its original context:

Each service controls certain actions with a set of options defined as Boolean values (on or off). This session will help you how to enable access to different services.

To view these Boolean options, you can use the getsebool command combined with grep to look for specific options.

After deciding which Boolean you’d like to change, you need to enable or disable the value appropriately. To achieve this, you can use the setsebool command. Suppose you want to be able to access your home directory through the web server. You need to adjust the httpd_enable_homedirs Boolean. 

There are few packages that you should install first:

You will also find the following two log files handy:

/var/log/audit/audit.log Logs SELinux denials

/var/log/messages Logs SELinux denials

Two common commands you can use to hunt for error messages include:

Problems can arise in SELinux for numberous reasons. However, the top three include:

Labeling problems: Using a nonstandard directory tends to cause problems if the directory or files aren’t labeled correctly.

Correct context: When you’re moving files, they can lose or retain incorrect contexts, causing access errors. Use the matchpathcon command to verify the correct context.

Confined service: If certain Booleans are not enable, a service may have trouble operating or communicating with other services.

Have fun!