[securityguide] Added a section about sVirt.
by Bara Ančincová
commit 4970f227a9350830f13b617ff21973d632aa22de
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Sun Aug 10 22:16:06 2014 +0200
Added a section about sVirt.
en-US/SVirt.xml | 120 ++++++++++++++++++++++++++++++++
en-US/Security_Guide.xml | 3 +-
en-US/images/after_virtualization.png | Bin 0 -> 40228 bytes
en-US/images/before_virtualization.png | Bin 0 -> 38560 bytes
en-US/images/selinux_uuid_block.png | Bin 0 -> 43395 bytes
5 files changed, 122 insertions(+), 1 deletions(-)
---
diff --git a/en-US/SVirt.xml b/en-US/SVirt.xml
new file mode 100644
index 0000000..3cd0ccd
--- /dev/null
+++ b/en-US/SVirt.xml
@@ -0,0 +1,120 @@
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+]>
+
+<section id="sect-Security-Enhanced_Linux-sVirt">
+ <title>sVirt</title>
+ <para>
+ sVirt is a technology included in &PRODUCT; that integrates SELinux and virtualization. sVirt applies Mandatory Access Control (MAC) to improve security when using virtual machines. The main reasons for integrating these technologies are to improve security and harden the system against bugs in the hypervisor that might be used as an attack vector aimed toward the host or to another virtual machine.
+ </para>
+ <para>
+ This chapter describes how sVirt integrates with virtualization technologies in &PRODUCT;.
+ </para>
+ <bridgehead renderas="sect2">Non-Virtualized Environment</bridgehead>
+ <para>
+ In a non-virtualized environment, hosts are separated from each other physically and each host has a self-contained environment, consisting of services such as a Web server, or a DNS server. These services communicate directly to their own user space, host kernel and physical host, offering their services directly to the network. The following image represents a non-virtualized environment:
+ </para>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="./images/before_virtualization.png" format="PNG" />
+ </imageobject>
+ </mediaobject>
+ <bridgehead renderas="sect2">Virtualized Environment</bridgehead>
+ <para>
+ In a virtualized environment, several operating systems can be housed (as "guests") within a single host kernel and physical host. The following image represents a virtualized environment:
+ </para>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="./images/after_virtualization.png" format="PNG" />
+ </imageobject>
+ </mediaobject>
+ <section id="sec-Security-Enhanced_Linux-Security_and_Virtualization">
+ <title>Security and Virtualization</title>
+ <para>
+ When services are not virtualized, machines are physically separated. Any exploit is usually contained to the affected machine, with the obvious exception of network attacks. When services are grouped together in a virtualized environment, extra vulnerabilities emerge in the system. If there is a security flaw in the hypervisor that can be exploited by a guest instance, this guest may be able to not only attack the host, but also other guests running on that host. This is not theoretical; attacks already exist on hypervisors. These attacks can extend beyond the guest instance and could expose other guests to attack.
+ </para>
+ <para>
+ sVirt is an effort to isolate guests and limit their ability to launch further attacks if exploited. This is demonstrated in the following image, where an attack cannot break out of the virtual machine and extend to another host instance:
+ </para>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="./images/selinux_uuid_block.png" format="PNG" />
+ </imageobject>
+ </mediaobject>
+ <para>
+ SELinux introduces a pluggable security framework for virtualized instances in its implementation of Mandatory Access Control (MAC). The sVirt framework allows guests and their resources to be uniquely labeled. Once labeled, rules can be applied which can reject access between different guests.
+ </para>
+ </section>
+ <section id="sec-Security-Enhanced_Linux-sVirt_Labeling">
+ <title>sVirt Labeling</title>
+ <para>
+ Like other services under the protection of SELinux, sVirt uses process-based mechanisms and restrictions to provide an extra layer of security over guest instances. Under typical use, you should not even notice that sVirt is working in the background. This section describes the labeling features of sVirt.
+ </para>
+ <para>
+ As shown in the following output, when using sVirt, each Virtual Machine (VM) process is labeled and runs with a dynamically generated level. Each process is isolated from other VMs with different levels:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>ps -eZ | grep qemu</command>
+
+system_u:system_r:svirt_t:s0:c87,c520 27950 ? 00:00:17 qemu-kvm
+system_u:system_r:svirt_t:s0:c639,c757 27989 ? 00:00:06 qemu-system-x86
+</screen>
+ <para>
+ The actual disk images are automatically labeled to match the processes, as shown in the following output:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>ls -lZ /var/lib/libvirt/images/*</command>
+
+system_u:object_r:svirt_image_t:s0:c87,c520 image1
+</screen>
+ <para>
+ The following table outlines the different labels that can be assigned when using sVirt:
+ </para>
+<table frame='all'><title>sVirt Labels</title>
+<tgroup cols='3' align='left' colsep='1' rowsep='1'>
+ <colspec colname='c1' />
+ <colspec colnum='2' colname='c2' />
+ <colspec colnum='3' colname='c3' />
+<thead>
+<row>
+ <entry namest="c1" nameend="c1" align="left">Type</entry>
+ <entry namest="c2" nameend="c2" align="left">SELinux Context</entry>
+ <entry namest="c2" nameend="c2" align="left">Description</entry>
+</row>
+</thead>
+<tbody>
+<row>
+ <entry>Virtual Machine Processes</entry>
+ <entry>system_u:system_r:svirt_t:MCS1</entry>
+ <entry>MCS1 is a randomly selected MCS field. Currently approximately 500,000 labels are supported.</entry>
+</row>
+<row>
+ <entry>Virtual Machine Image</entry>
+ <entry>system_u:object_r:svirt_image_t:MCS1</entry>
+ <entry>Only processes labeled <emphasis>svirt_t</emphasis> with the same MCS fields are able to read/write these image files and devices.</entry>
+</row>
+<row>
+ <entry>Virtual Machine Shared Read/Write Content</entry>
+ <entry>system_u:object_r:svirt_image_t:s0</entry>
+ <entry>All processes labeled <emphasis>svirt_t</emphasis> are allowed to write to the svirt_image_t:s0 files and devices.</entry>
+</row>
+<!--
+ <row>
+ <entry>Virtual Machine Shared Shared Read Only content</entry>
+ <entry>system_u:object_r:svirt_content_t:s0</entry>
+ <entry>All svirt_t processes are able to read files/devices with this label.</entry>
+ </row>
+-->
+<row>
+ <entry>Virtual Machine Image</entry>
+ <entry>system_u:object_r:virt_content_t:s0</entry>
+ <entry>System default label used when an image exits. No <emphasis>svirt_t</emphasis> virtual processes are allowed to read files/devices with this label.</entry>
+</row>
+</tbody>
+</tgroup>
+</table>
+ <para>
+ It is also possible to perform static labeling when using sVirt. Static labels allow the administrator to select a specific label, including the MCS/MLS field, for a virtual machine. Administrators who run statically-labeled virtual machines are responsible for setting the correct label on the image files. The virtual machine will always be started with that label, and the sVirt system will never modify the label of a statically-labeled virtual machine's content. This allows the sVirt component to run in an MLS environment. You can also run multiple virtual machines with different sensitivity levels on a system, depending on your requirements.
+ </para>
+ </section>
+</section>
diff --git a/en-US/Security_Guide.xml b/en-US/Security_Guide.xml
index 7256d28..ac27720 100644
--- a/en-US/Security_Guide.xml
+++ b/en-US/Security_Guide.xml
@@ -25,7 +25,8 @@
<xi:include href="Targeted_Policy.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Working_With_SELinux.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="sepolicy_Suite.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
- <xi:include href="Managing_Users.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
+ <xi:include href="Managing_Users.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
+ <xi:include href="SVirt.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Troubleshooting.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Further_Information.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
</chapter>
diff --git a/en-US/images/after_virtualization.png b/en-US/images/after_virtualization.png
new file mode 100644
index 0000000..d5f7179
Binary files /dev/null and b/en-US/images/after_virtualization.png differ
diff --git a/en-US/images/before_virtualization.png b/en-US/images/before_virtualization.png
new file mode 100644
index 0000000..075296c
Binary files /dev/null and b/en-US/images/before_virtualization.png differ
diff --git a/en-US/images/selinux_uuid_block.png b/en-US/images/selinux_uuid_block.png
new file mode 100644
index 0000000..9a4197a
Binary files /dev/null and b/en-US/images/selinux_uuid_block.png differ
9 years, 9 months
[securityguide] Updated Confined Users with new content from RHEL 7.
by Bara Ančincová
commit 6e808f1da219eefced79f78e967470491aa73fbe
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Fri Aug 8 16:19:56 2014 +0200
Updated Confined Users with new content from RHEL 7.
en-US/Managing_Users.xml | 331 ++++++++++++++++++++++------------------------
1 files changed, 158 insertions(+), 173 deletions(-)
---
diff --git a/en-US/Managing_Users.xml b/en-US/Managing_Users.xml
index 66cc315..dba9fcb 100644
--- a/en-US/Managing_Users.xml
+++ b/en-US/Managing_Users.xml
@@ -2,315 +2,300 @@
<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
]>
-<section id="sect-Security-Enhanced_Linux-Confining_Users">
+<section id="chap-Security-Enhanced_Linux-Confining_Users">
<title>Confining Users</title>
<para>
- A number of confined SELinux users are available in &PRODUCT; &PRODVER;. Each Linux user is mapped to an SELinux user via SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it); or run the <command>su</command> and <command>sudo</command> commands. This helps protect the system from the user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> for further information about confined users.
+ A number of confined SELinux users are available in &PRODUCT;. Each Linux user is mapped to an SELinux user using SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it); or run the <command>su</command> and <command>sudo</command> commands. This helps protect the system from the user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> for further information about confined users.
</para>
<section id="sect-Security-Enhanced_Linux-Confining_Users-Linux_and_SELinux_User_Mappings">
<title>Linux and SELinux User Mappings</title>
<para>
- As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between Linux users and SELinux users:
+ As the root user, run the following command to view the mapping between Linux users and SELinux users:
</para>
-<screen># /usr/sbin/semanage login -l
+<screen>
+<prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
<para>
- In &PRODUCT; &PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). When a Linux user is created with the <command>useradd</command> command, if no options are specified, they are mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. The following defines the default-mapping:
+ In &PRODUCT;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <systemitem>unconfined_u</systemitem> user). When a Linux user is created with the <command>useradd</command> command, if no options are specified, they are mapped to the SELinux <systemitem>unconfined_u</systemitem> user. The following defines the default-mapping:
</para>
<screen>
-__default__ unconfined_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
</screen>
</section>
<section id="sect-Security-Enhanced_Linux-Confining_Users-Confining_New_Linux_Users_useradd">
<title>Confining New Linux Users: useradd</title>
<para>
- Linux users mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user run in the <computeroutput>unconfined_t</computeroutput> domain. This is seen by running the <command>id -Z</command> command while logged-in as a Linux user mapped to <computeroutput>unconfined_u</computeroutput>:
+ Linux users mapped to the SELinux <systemitem>unconfined_u</systemitem> user run in the <systemitem>unconfined_t</systemitem> domain. This is seen by running the <command>id -Z</command> command while logged-in as a Linux user mapped to <systemitem>unconfined_u</systemitem>:
</para>
<screen>
-$ id -Z
+<prompt>~]$</prompt> <command>id -Z</command>
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
</screen>
<para>
- When Linux users run in the <computeroutput>unconfined_t</computeroutput> domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the <computeroutput>unconfined_t</computeroutput> domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application.
- </para>
+ When Linux users run in the <systemitem>unconfined_t</systemitem> domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the <systemitem>unconfined_t</systemitem> domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the <systemitem>unconfined_t</systemitem> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy.
+ </para>
+ <note>
+ <para>
+ This does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application.
+ </para>
+ </note>
<para>
- When creating Linux users with <command>useradd</command>, use the <option>-Z</option> option to specify which SELinux user they are mapped to. The following example creates a new Linux user, useruuser, and maps that user to the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped to the SELinux <computeroutput>user_u</computeroutput> user run in the <computeroutput>user_t</computeroutput> domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as <command>passwd</command>), and can not run <command>su</command> or <command>sudo</command>, preventing them from becoming the Linux root user with these commands.
+ When creating Linux users with the <command>useradd</command> command, use the <option>-Z</option> option to specify which SELinux user they are mapped to. The following example creates a new Linux user, <literal>useruuser</literal>, and maps that user to the SELinux <systemitem>user_u</systemitem> user. Linux users mapped to the SELinux <systemitem>user_u</systemitem> user run in the <systemitem>user_t</systemitem> domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as <systemitem>passwd</systemitem>), and cannot run the <command>su</command> or <command>sudo</command> command, preventing them from becoming the root user with these commands.
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-managing-users-confining-new-linux-users-useradd">
+ <title>Confining a New Linux User to <systemitem>user_u</systemitem> SELinux User</title>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u useruuser</command> command to create a new Linux user (useruuser) that is mapped to the SELinux <computeroutput>user_u</computeroutput> user.
- </para>
- </listitem>
- <listitem>
+ As root, create a new Linux user (<literal>useruuser</literal>) that is mapped to the SELinux <systemitem>user_u</systemitem> user.
+ </para>
+<screen><prompt>~]#</prompt> <command>useradd -Z user_u useruuser</command></screen>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between the Linux <computeroutput>useruuser</computeroutput> user and <computeroutput>user_u</computeroutput>:
- </para>
-
+ To view the mapping between <literal>useruuser</literal> and <systemitem>user_u</systemitem>, run the following command as root:
+ </para>
<screen>
-# /usr/sbin/semanage login -l
+<prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
-useruuser user_u s0
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
+useruuser user_u s0 *
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>passwd useruuser</command> command to assign a password to the Linux useruuser user:
+ As root, assign a password to the Linux <literal>useruuser</literal> user:
</para>
<screen>
-# passwd useruuser
+<prompt>~]#</prompt> <command>passwd useruuser</command>
Changing password for user useruuser.
-New UNIX password: <replaceable>Enter a password</replaceable>
-Retype new UNIX password: <replaceable>Enter the same password again</replaceable>
+New password: <replaceable>Enter a password</replaceable>
+Retype new password: <replaceable>Enter the same password again</replaceable>
passwd: all authentication tokens updated successfully.
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Log out of your current session, and log in as the Linux useruuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, <computeroutput>user_u</computeroutput>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:
+ Log out of your current session, and log in as the Linux <literal>useruuser</literal> user. When you log in, the <systemitem>pam_selinux</systemitem> module maps the Linux user to an SELinux user (in this case, <systemitem>user_u</systemitem>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the following command to view the context of a Linux user:
</para>
-
<screen>
-[useruuser@localhost ~]$ id -Z
+<prompt>~]$</prompt> <command>id -Z</command>
user_u:user_r:user_t:s0
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Log out of the Linux useruuser's session, and log back in with your account. If you do not want the Linux useruuser user, run the <command>/usr/sbin/userdel -r useruuser</command> command as the Linux root user to remove it, along with its home directory.
- </para>
- </listitem>
- </orderedlist>
+ Log out of the Linux <literal>useruuser</literal>'s session, and log back in with your account. If you do not want the Linux <literal>useruuser</literal> user, run the following command as root to remove it, along with its home directory:
+ </para>
+<screen><prompt>~]#</prompt> <command>userdel -r useruuser</command></screen>
+ </step>
+ </procedure>
</section>
<section id="sect-Security-Enhanced_Linux-Confining_Users-Confining_Existing_Linux_Users_semanage_login">
- <title>Confining Existing Linux Users: semanage login</title>
+ <title>Confining Existing Linux Users: semanage login</title>
<para>
- If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user (the default behavior), and you would like to change which SELinux user they are mapped to, use the <command>semanage login</command> command. The following example creates a new Linux user named newuser, then maps that Linux user to the SELinux <computeroutput>user_u</computeroutput> user:
+ If a Linux user is mapped to the SELinux <systemitem>unconfined_u</systemitem> user (the default behavior), and you would like to change which SELinux user they are mapped to, use the <command>semanage login</command> command. The following example creates a new Linux user named <literal>newuser</literal>, then maps that Linux user to the SELinux <systemitem>user_u</systemitem> user:
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-managing-users-confining-existing-linux-users-semanage-login">
+ <title>Mapping Linux Users to the SELinux Users</title>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user (newuser). Since this user uses the default mapping, it does not appear in the <command>/usr/sbin/semanage login -l</command> output:
+ As the root user, create a new Linux user (<literal>newuser</literal>). Since this user uses the default mapping, it does not appear in the <command>semanage login -l</command> output:
</para>
-
+<screen><prompt>~]#</prompt> <command>useradd newuser</command></screen>
<screen>
-# /usr/sbin/semanage login -l
+<prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
- </listitem>
- <listitem>
- <para>
- To map the Linux newuser user to the SELinux <computeroutput>user_u</computeroutput> user, run the following command as the Linux root user:
- </para>
+ </step>
+ <step>
<para>
- <command>/usr/sbin/semanage login -a -s user_u newuser</command>
+ To map the Linux <literal>newuser</literal> user to the SELinux <systemitem>user_u</systemitem> user, run the following command as root:
</para>
+<screen>
+<prompt>~]#</prompt> <command>semanage login -a -s user_u newuser</command>
+</screen>
<para>
The <option>-a</option> option adds a new record, and the <option>-s</option> option specifies the SELinux user to map a Linux user to. The last argument, <computeroutput>newuser</computeroutput>, is the Linux user you want mapped to the specified SELinux user.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- To view the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput>, run the <command>semanage login -l</command> command as the Linux root user:
+ To view the mapping between the Linux <literal>newuser</literal> user and <systemitem>user_u</systemitem>, use the <systemitem>semanage</systemitem> utility again:
</para>
-
<screen>
-# /usr/sbin/semanage login -l
+<prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-newuser user_u s0
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+newuser user_u s0 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:
+ As root, assign a password to the Linux <literal>newuser</literal> user:
</para>
-
<screen>
-# passwd newuser
+<prompt>~]#</prompt> <command>passwd newuser</command>
Changing password for user newuser.
-New UNIX password: <replaceable>Enter a password</replaceable>
-Retype new UNIX password: <replaceable>Enter the same password again</replaceable>
+New password: <replaceable>Enter a password</replaceable>
+Retype new password: <replaceable>Enter the same password again</replaceable>
passwd: all authentication tokens updated successfully.
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Log out of your current session, and log in as the Linux newuser user. Run the <command>id -Z</command> command to view the newuser's SELinux context:
+ Log out of your current session, and log in as the Linux <literal>newuser</literal> user. Run the following command to view the <literal>newuser</literal>'s SELinux context:
</para>
-
<screen>
-[newuser@rlocalhost ~]$ id -Z
-user_u:user_r:user_t:s0
-</screen>
- </listitem>
- <listitem>
+<prompt>~]$</prompt> <command>id -Z</command>
+user_u:user_r:user_t:s0</screen>
+ </step>
+ <step>
<para>
- Log out of the Linux newuser's session, and log back in with your account. If you do not want the Linux newuser user, run the <command>userdel -r newuser</command> command as the Linux root user to remove it, along with its home directory. Also, the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput> is removed:
+ Log out of the Linux <literal>newuser</literal>'s session, and log back in with your account. If you do not want the Linux <literal>newuser</literal> user, run the following command as root to remove it, along with its home directory:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>userdel -r newuser</command>
+</screen>
+ <para>
+ As root, remove the mapping between the Linux <literal>newuser</literal> user and <systemitem>user_u</systemitem>:
</para>
-
+<screen><prompt>~]#</prompt> <command>semanage login -d newuser</command></screen>
<screen>
-# /usr/sbin/userdel -r newuser
-# /usr/sbin/semanage login -l
+<prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
- </listitem>
- </orderedlist>
+ </step>
+ </procedure>
</section>
<section id="sect-Security-Enhanced_Linux-Confining_Users-Changing_the_Default_Mapping">
<title>Changing the Default Mapping</title>
<para>
- In &PRODUCT; &PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). If you would like new Linux users, and Linux users not specifically mapped to an SELinux user to be confined by default, change the default mapping with the <command>semanage login</command> command.
- </para>
- <para>
- For example, run the following command as the Linux root user to change the default mapping from <computeroutput>unconfined_u</computeroutput> to <computeroutput>user_u</computeroutput>:
+ In &PRODUCT;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <systemitem>unconfined_u</systemitem> user). If you would like new Linux users, and Linux users not specifically mapped to an SELinux user to be confined by default, change the default mapping with the <command>semanage login</command> command.
</para>
<para>
- <command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__</command>
+ For example, run the following command as root to change the default mapping from <systemitem>unconfined_u</systemitem> to <systemitem>user_u</systemitem>:
</para>
+<screen><prompt>~]#</prompt> <command>semanage login -m -S targeted -s "user_u" -r s0 __default__</command>
+ </screen>
<para>
- Run the <command>semanage login -l</command> command as the Linux root user to verify the <computeroutput>__default__</computeroutput> login is mapped to <computeroutput>user_u</computeroutput>:
+ Verify the <computeroutput>__default__</computeroutput> login is mapped to <systemitem>user_u</systemitem>:
</para>
-
<screen>
-# /usr/sbin/semanage login -l
+<prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ user_u s0
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ user_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
<para>
- If a new Linux user is created and an SELinux user is not specified, or if an existing Linux user logs in and does not match a specific entry from the <command>semanage login -l</command> output, they are mapped to <computeroutput>user_u</computeroutput>, as per the <computeroutput>__default__</computeroutput> login.
+ If a new Linux user is created and an SELinux user is not specified, or if an existing Linux user logs in and does not match a specific entry from the <command>semanage login -l</command> output, they are mapped to <systemitem>user_u</systemitem>, as per the <computeroutput>__default__</computeroutput> login.
</para>
<para>
- To change back to the default behavior, run the following command as the Linux root user to map the <computeroutput>__default__</computeroutput> login to the SELinux <computeroutput>unconfined_u</computeroutput> user:
+ To change back to the default behavior, run the following command as root to map the <computeroutput>__default__</computeroutput> login to the SELinux <systemitem>unconfined_u</systemitem> user:
</para>
-
-
-<screen>/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r\
-s0-s0:c0.c1023 __default__
+<screen>
+<prompt>~]#</prompt> <command>semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 __default__</command>
</screen>
-
</section>
<section id="sect-Security-Enhanced_Linux-Confining_Users-xguest_Kiosk_Mode">
<title>xguest: Kiosk Mode</title>
<para>
- The <package>xguest</package> package provides a kiosk user account. This account is used to secure machines that people walk up to and use, such as those at libraries, banks, airports, information kiosks, and coffee shops. The kiosk user account is very limited: essentially, it only allows users to log in and use <application>Firefox</application> to browse Internet websites. Any changes made while logged in with his account, such as creating files or changing settings, are lost when you log out.
+ The <package>xguest</package> package provides a kiosk user account. This account is used to secure machines that people walk up to and use, such as those at libraries, banks, airports, information kiosks, and coffee shops. The kiosk user account is very limited: essentially, it only allows users to log in and use <application>Firefox</application> to browse Internet websites. Any changes made while logged in with this account, such as creating files or changing settings, are lost when you log out.
</para>
<para>
To set up the kiosk account:
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-managing-users-setting-up-the-kiosk-account">
+ <step>
<para>
- As the Linux root user, run <command>yum install xguest</command> command to install the <package>xguest</package> package. Install dependencies as required.
- </para>
- </listitem>
- <listitem>
+ As the root user, install the <package>xguest</package> package. Install dependencies as required:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>yum install xguest</command>
+</screen>
+ </step>
+ <step>
<para>
- In order to allow the kiosk account to be used by a variety of people, the account is not password-protected, and as such, the account can only be protected if SELinux is running in enforcing mode. Before logging in with this account, use the <command>getenforce</command> command to confirm that SELinux is running in enforcing mode:
+ In order to allow the kiosk account to be used by a variety of people, the account is not password-protected, and as such, the account can only be protected if SELinux is running in enforcing mode. Before logging in with this account, use the <systemitem>getenforce</systemitem> utility to confirm that SELinux is running in enforcing mode:
</para>
-
<screen>
-$ /usr/sbin/getenforce
+<prompt>~]$</prompt> <command>getenforce</command>
Enforcing
</screen>
-<!-- <para>
- If this is not the case, refer to <xref linkend="" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled.
- </para> -->
- </listitem>
- <listitem>
<para>
- You can only log in to this account via the GNOME Display Manager (GDM). Once the <package>xguest</package> package is installed, a <computeroutput>Guest</computeroutput> account is added to GDM. To log in, click on the <computeroutput>Guest</computeroutput> account:
+ If this is not the case, see <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled.
+ </para>
+ </step>
+ <step>
+ <para>
+ You can only log in to this account via the GNOME Display Manager (GDM). Once the <package>xguest</package> package is installed, a <computeroutput>Guest</computeroutput> account is added to the GDM login screen.
</para>
- <mediaobject>
- <imageobject>
- <imagedata fileref="./images/xguest.png" format="PNG" />
- </imageobject>
- </mediaobject>
- </listitem>
- </orderedlist>
+ </step>
+ </procedure>
</section>
<section id="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications">
<title>Booleans for Users Executing Applications</title>
<para>
- Not allowing Linux users to execute applications (which inherit users' permissions) in their home directories and <filename>/tmp/</filename>, which they have write access to, helps prevent flawed or malicious applications from modifying files that users own. In &PRODUCT; &PRODVER;, by default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>; however, by default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can.
+ Not allowing Linux users to execute applications (which inherit users' permissions) in their home directories and the <filename class="directory">/tmp/</filename> directory, which they have write access to, helps prevent flawed or malicious applications from modifying files that users own. In &PRODUCT;, by default, Linux users in the <systemitem>guest_t</systemitem> and <systemitem>xguest_t</systemitem> domains cannot execute applications in their home directories or <filename class="directory">/tmp/</filename>; however, by default, Linux users in the <systemitem>user_t</systemitem> and <systemitem>staff_t</systemitem> domains can.
</para>
<para>
- Booleans are available to change this behavior, and are configured with the <command>setsebool</command> command. The <command>setsebool</command> command must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-guest_t">
- <title>guest_t</title>
+ Booleans are available to change this behavior, and are configured with the <systemitem>setsebool</systemitem> utility, which must be run as the root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:
+ </para>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-guest_t">guest_t</bridgehead>
<para>
- To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:
+ To <emphasis>allow</emphasis> Linux users in the <systemitem>guest_t</systemitem> domain to execute applications in their home directories and <filename class="directory">/tmp/</filename>:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P allow_guest_exec_content on</command>
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-xguest_t">
- <title>xguest_t</title>
+<screen><prompt>~]#</prompt> <command>setsebool -P guest_exec_content on</command></screen>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-xguest_t">xguest_t</bridgehead>
<para>
- To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:
+ To <emphasis>allow</emphasis> Linux users in the <systemitem>xguest_t</systemitem> domain to execute applications in their home directories and <filename class="directory">/tmp/</filename>:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P allow_xguest_exec_content on</command>
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-user_t">
- <title>user_t</title>
+<screen><prompt>~]#</prompt> <command>setsebool -P xguest_exec_content on</command></screen>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-user_t">user_t</bridgehead>
<para>
- To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:
+ To <emphasis>prevent</emphasis> Linux users in the <systemitem>user_t</systemitem> domain from executing applications in their home directories and <filename class="directory">/tmp/</filename>:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P allow_user_exec_content off</command>
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-staff_t">
- <title>staff_t</title>
+<screen><prompt>~]#</prompt> <command>setsebool -P user_exec_content off</command></screen>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_Users_Executing_Applications-staff_t">staff_t</bridgehead>
<para>
- To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:
+ To <emphasis>prevent</emphasis> Linux users in the <systemitem>staff_t</systemitem> domain from executing applications in their home directories and <filename class="directory">/tmp/</filename>:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P allow_staff_exec_content off</command>
- </para>
+<screen><prompt>~]#</prompt> <command>setsebool -P staff_exec_content off</command></screen>
</section>
</section>
9 years, 9 months
[securityguide] Added a section about sepolicy Suite.
by Bara Ančincová
commit f18f8849b261dd608ae2c95f9bf6dc2ee7046e07
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Fri Aug 8 16:08:46 2014 +0200
Added a section about sepolicy Suite.
en-US/Security_Guide.xml | 3 +-
en-US/sepolicy_Suite.xml | 354 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 356 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Security_Guide.xml b/en-US/Security_Guide.xml
index f707385..7256d28 100644
--- a/en-US/Security_Guide.xml
+++ b/en-US/Security_Guide.xml
@@ -23,7 +23,8 @@
<xi:include href="Introduction.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Contexts_and_Attributes.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Targeted_Policy.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
- <xi:include href="Working_With_SELinux.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
+ <xi:include href="Working_With_SELinux.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
+ <xi:include href="sepolicy_Suite.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Managing_Users.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Troubleshooting.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Further_Information.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
diff --git a/en-US/sepolicy_Suite.xml b/en-US/sepolicy_Suite.xml
new file mode 100644
index 0000000..d37a896
--- /dev/null
+++ b/en-US/sepolicy_Suite.xml
@@ -0,0 +1,354 @@
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+]>
+
+<section id="chap-Security-Enhanced_Linux-the_sepolicy_Suite">
+ <title>The <systemitem>sepolicy</systemitem> Suite</title>
+ <para>
+ The <systemitem>sepolicy</systemitem> utility provides a suite of features to query the installed SELinux policy. These features are either new or were previously provided by separate utilities, such as <systemitem>sepolgen</systemitem> or <systemitem>setrans</systemitem>. The suite allows you to generate transition reports, man pages, or even new policy modules, thus giving users easier access and better understanding of the SELinux policy.
+ </para>
+ <para>
+ The <package>policycoreutils-devel</package> package provides <systemitem>sepolicy</systemitem>. Run the following command as the root user to install <systemitem>sepolicy</systemitem>:
+ </para>
+<screen><prompt>~]#</prompt> <command>yum install policycoreutils-devel</command></screen>
+ <para>
+ The <systemitem>sepolicy</systemitem> suite provides the following features that are invoked as command-line parameters:
+ </para>
+ <table id="sepolicy_options">
+ <title>The <systemitem>sepolicy</systemitem> Features</title>
+ <tgroup cols="2">
+ <colspec colname="c1" colnum="1" colwidth="1*" />
+ <colspec colname="c2" colnum="2" colwidth="3*" />
+ <thead>
+ <row>
+ <entry>
+ Feature
+ </entry>
+ <entry>
+ Description
+ </entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>
+ booleans
+ </entry>
+ <entry>
+ Query the SELinux Policy to see description of Booleans
+ </entry>
+ </row>
+ <row>
+ <entry>
+ communicate
+ </entry>
+ <entry>
+ Query the SELinux policy to see if domains can communicate with each other
+ </entry>
+ </row>
+ <row>
+ <entry>
+ generate
+ </entry>
+ <entry>
+ Generate an SELinux policy module template
+ </entry>
+ </row>
+ <row>
+ <entry>
+ gui
+ </entry>
+ <entry>
+ Graphical User Interface for SELinux Policy
+ </entry>
+ </row>
+ <row>
+ <entry>
+ interface
+ </entry>
+ <entry>
+ List SELinux Policy interfaces
+ </entry>
+ </row>
+ <row>
+ <entry>
+ manpage
+ </entry>
+ <entry>
+ Generate SELinux man pages
+ </entry>
+ </row>
+ <row>
+ <entry>
+ network
+ </entry>
+ <entry>
+ Query SELinux policy network information
+ </entry>
+ </row>
+ <row>
+ <entry>
+ transition
+ </entry>
+ <entry>
+ Query SELinux policy and generate a process transition report
+ </entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ <section id="Security-Enhanced_Linux-The-sepolicy-Suite-The_sepolicy_python_bindings">
+ <title>The <systemitem>sepolicy</systemitem> Python Bindings</title>
+ <para>
+ In previous versions of &PRODUCT;, the <package>setools</package> package included the <systemitem>sesearch</systemitem> and <systemitem>seinfo</systemitem> utilities. The <systemitem>sesearch</systemitem> utility is used for searching rules in a SELinux policy while the <systemitem>seinfo</systemitem> utility allows you to query various other components in the policy.
+ </para>
+ <para>
+ In newer versions of &PRODUCT;, Python bindings for <systemitem>sesearch</systemitem> and <systemitem>seinfo</systemitem> have been added so that you can use the functionality of these utilities via the <systemitem>sepolicy</systemitem> suite. See the example below:
+ </para>
+<screen>
+> python
+>>> import sepolicy
+>>> sepolicy.info(sepolicy.ATTRIBUTE)
+Returns a dictionary of all information about SELinux Attributes
+>>>sepolicy.search([sepolicy.ALLOW])
+Returns a dictionary of all allow rules in the policy.
+</screen>
+
+ </section>
+ <section id="Security-Enhanced_Linux-The-sepolicy-Suite-sepolicy_generate">
+ <title>Generating SELinux Policy Modules: <command>sepolicy generate</command></title>
+
+ <para>
+ In previous versions of &PRODUCT;, the <systemitem>sepolgen</systemitem> or <systemitem>selinux-polgengui</systemitem> utilities were used for generating a SELinux policy. These tools have been merged to the <systemitem>sepolicy</systemitem> suite and the <systemitem>sepolicy generate</systemitem> command is used to generate an initial SELinux policy module template.
+ </para>
+ <para>
+ Unlike <systemitem>sepolgen</systemitem>, it is not necessary to run <command>sepolicy generate</command> as the root user. This utility also creates an RPM spec file, which can be used to build an RPM package that installs the policy package file (<filename><replaceable>NAME</replaceable>.pp</filename>) and the interface file (<filename><replaceable>NAME</replaceable>.if</filename>) to the correct location, provides installation of the SELinux policy into the kernel, and fixes the labeling. The setup script continues to install SELinux policy and sets up the labeling. In addition, a manual page based on the installed policy is generated using the <command>sepolicy manpage</command> command.<footnote>
+ <para>
+ See <xref linkend="Security-Enhanced_Linux-The-sepolicy-Suite-sepolicy_manpage"/> for more information about <systemitem>sepolicy manpage</systemitem>.
+ </para>
+ </footnote> Finally, <command>sepolicy generate</command> builds and compiles the SELinux policy and the manual page into an RPM package, ready to be installed on other systems.
+ </para>
+
+ <para>
+ When <systemitem>sepolicy generate</systemitem> is executed, the following files are produced:
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term><filename><replaceable>NAME</replaceable>.te</filename> – type enforcing file</term>
+ <listitem>
+ <para>
+ This file defines all the types and rules for a particular domain.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><filename><replaceable>NAME</replaceable>.if</filename> – interface file</term>
+ <listitem>
+ <para>
+ This file defines the default file context for the system. It takes the file types created in the <filename>NAME.te</filename> file and associates file paths to the types. Utilities, such as <systemitem>restorecon</systemitem> and <systemitem>rpm</systemitem>, use these paths to write labels.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><filename><replaceable>NAME</replaceable>_selinux.spec</filename> – RPM spec file</term>
+ <listitem>
+ <para>
+ This file is an RPM spec file that installs SELinux policy and sets up the labeling. This file also installs the interface file and a man page describing the policy. You can use the <command>sepolicy manpage -d <replaceable>NAME</replaceable></command> command to generate the man page.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><filename><replaceable>NAME</replaceable>.sh</filename> – helper shell script</term>
+ <listitem>
+ <para>
+ This script helps to compile, install, and fix the labeling on the system. It also generates a man page based on the installed policy, compiles, and builds an RPM package suitable to be installed on other systems.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ <para>
+ If it is possible to generate an SELinux policy module, <systemitem>sepolicy generate</systemitem> prints out all generated paths from the source domain to the target domain. See the <citerefentry><refentrytitle>sepolicy-generate</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information about <systemitem>sepolicy generate</systemitem>.
+ </para>
+
+ </section>
+ <section id="Security-Enhanced_Linux-The-sepolicy-Suite-sepolicy_transition">
+ <title>Understanding Domain Transitions: <command>sepolicy transition</command></title>
+ <para>
+ Previously, the <systemitem>setrans</systemitem> utility was used to examine if transition between two domain or process types is possible and printed out all intermediary types that are used to transition between these domains or processes. Now, <systemitem>setrans</systemitem> is provided as part of the <systemitem>sepolicy</systemitem> suite and the <systemitem>sepolicy transition</systemitem> command is now used instead.
+ </para>
+ <para>
+ The <systemitem>sepolicy transition</systemitem> command queries a SELinux policy and creates a process transition report. The <command>sepolicy transition</command> command requires two command-line arguments – a source domain (specified by the <option>-s</option> option) and a target domain (specified by the <option>-t</option> option). If only the source domain is entered, <systemitem>sepolicy transition</systemitem> lists all possible domains that the source domain can transition to. The following output does not contain all entries. The <quote>@</quote> character means <quote>execute</quote>:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>sepolicy transition -s httpd_t</command>
+httpd_t @ httpd_suexec_exec_t --> httpd_suexec_t
+httpd_t @ mailman_cgi_exec_t --> mailman_cgi_t
+httpd_t @ abrt_retrace_worker_exec_t --> abrt_retrace_worker_t
+httpd_t @ dirsrvadmin_unconfined_script_exec_t --> dirsrvadmin_unconfined_script_t
+httpd_t @ httpd_unconfined_script_exec_t --> httpd_unconfined_script_t
+</screen>
+ <para>
+ If the target domain is specified, <systemitem>sepolicy transition</systemitem> examines SELinux policy for all transition paths from the source domain to the target domain and lists these paths. The output below is not complete:
+ </para>
+
+<screen>
+<prompt>~]$</prompt> <command>sepolicy transition -s httpd_t -t system_mail_t</command>
+httpd_t @ exim_exec_t --> system_mail_t
+httpd_t @ courier_exec_t --> system_mail_t
+httpd_t @ sendmail_exec_t --> system_mail_t
+httpd_t ... httpd_suexec_t @ sendmail_exec_t --> system_mail_t
+httpd_t ... httpd_suexec_t @ exim_exec_t --> system_mail_t
+httpd_t ... httpd_suexec_t @ courier_exec_t --> system_mail_t
+httpd_t ... httpd_suexec_t ... httpd_mojomojo_script_t @ sendmail_exec_t --> system_mail_t
+</screen>
+ <para>
+ See the <citerefentry><refentrytitle>sepolicy-transition</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information about <systemitem>sepolicy transition</systemitem>.
+ </para>
+
+ </section>
+ <section id="Security-Enhanced_Linux-The-sepolicy-Suite-sepolicy_manpage">
+ <title>Generating Manual Pages: <command>sepolicy manpage</command></title>
+ <para>
+ The <systemitem>sepolicy manpage</systemitem> command generates manual pages based on the SELinux policy that document process domains. As a result, such documentation is always up-to-date. Each name of automatically generated manual pages consists of the process domain name and the <literal>_selinux</literal> suffix, for example <literal>httpd_selinux</literal>.
+ </para>
+ <para>
+ The manual pages include several sections that provide information about various parts of the SELinux policy for confined domains:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ The <literal>Entrypoints</literal> section contains all executable files that need to be executed during a domain transition.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>Process Types</literal> section lists all process types that begin with the same prefix as the target domain.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>Booleans</literal> section lists Booleans associated with the domain.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>Port Types</literal> section contains the port types matching the same prefix as the domain and describes the default port numbers assigned to these port types.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>Managed Files</literal> section describes the types that the domain is allowed to write to and the default paths associated with these types.
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The <literal>File Contexts</literal> section contains all file types associated with the domain and describes how to use these file types along with the default path labeling on a system.
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The <literal>Sharing Files</literal> section explains how to use the domain sharing types, such as <systemitem>public_content_t</systemitem>.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <para>
+ See the <citerefentry><refentrytitle>sepolicy-manpage</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information about <systemitem>sepolicy manpage</systemitem>.
+ </para>
+ </section>
+ <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Management">
+ <title>Manage SELinux Graphically <command>sepolicy gui</command></title>
+ <para>
+ <remark>WIP</remark>
+ </para>
+ <para>
+ It is possible to manage SELinux graphically using the SELinux GUI interface, which is provided by the <package>policycoreutils-gui</package> package. This package is not installed by default. To install it, run the following command as root:
+ </para>
+ <screen>~]# <command>yum install policycoreutils-gui</command></screen>
+ <para>
+ To launch the GUI interface either run the <command>sepolicy gui</command> command or navigate through the <guimenu>Applications</guimenu> menu to the <guisubmenu>Other</guisubmenu> submenu and then select <application>SELinux Policy Management Tool</application>.
+ </para>
+ <!--<para>
+ The SELinux GUI consists of three separate utilities:
+ </para>
+ <variablelist>
+ <varlistentry>
+ <term><application>SELinux Management</application> <remark>SELinux Administration</remark></term>
+ <listitem>
+ <para>
+ This utility allows you to manage SELinux, for example: <remark>are these tasks that can be done by semanage?</remark>
+ <itemizedlist>
+ <listitem>
+ <para>
+ Set up SELinux modes and the default SELinux policy type (see <xref linkend="sect-Security-Enhanced_Linux-Introduction-SELinux_Modes" /> and <xref linkend="chap-Security-Enhanced_Linux-Targeted_Policy" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Enable or disable Booleans (see <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Manage file labels (see <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Contexts_Labeling_Files" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Add, edit, or delete user mappings (see <xref linkend="chap-Security-Enhanced_Linux-Confining_Users" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Manage SELinux users (see <xref linkend="chap-Security-Enhanced_Linux-Confining_Users" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Maintain network ports for services (see <xref linkend="brid-Security-Enhanced_Linux-How_are_Confined_Services_Running-Port_Numbers" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Manage policy modules (see <xref linkend="Security-Enhanced_Linux-The-sepolicy-Suite-sepolicy_generate" />)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ List process domains and set SELinux mode for a particular domain to permissive or enforcing (see <remark>what chapter?</remark>)
+ </para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ <para>
+ To launch this utility, navigate through the <guimenu>Applications</guimenu> menu to the <guisubmenu>Other</guisubmenu> submenu and then select <application>SELinux Management</application>. Note that the root password is required to use <application>SELinux Management</application>.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><application>SELinux Policy Management Tool</application> <remark>SELinux Configuration</remark></term>
+ <listitem>
+ <para>
+ <remark>TBD</remark>
+ </para>
+ <para>
+ To launch this utility, navigate through the <guimenu>Applications</guimenu> menu to the <guisubmenu>Other</guisubmenu> submenu and then select <application>SELinux Policy Management Tool</application>.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><application>SELinux Policy Generation Tool</application></term>
+ <listitem>
+ <para>
+ <remark>TBD</remark>
+ </para>
+ <para>
+ To launch this utility, navigate through the <guimenu>Applications</guimenu> menu to the <guisubmenu>System Tools</guisubmenu> submenu and then select <application>SELinux Policy Generation Tool</application>.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>-->
+ </section>
+</section>
9 years, 9 months
[securityguide] Updated Working with SELinux with new content from RHEL7.
by Bara Ančincová
commit cc77efa99b67339b28ae24f25e22dabb9ff61d49
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Fri Aug 8 15:56:45 2014 +0200
Updated Working with SELinux with new content from RHEL7.
en-US/Managing_Users.xml | 6 +-
en-US/Working_With_SELinux.xml | 2443 ++++++++++++++++++++-----------
en-US/images/security-intro-to-mls.png | Bin 0 -> 19654 bytes
en-US/images/security-mls-data-flow.png | Bin 0 -> 14986 bytes
4 files changed, 1606 insertions(+), 843 deletions(-)
---
diff --git a/en-US/Managing_Users.xml b/en-US/Managing_Users.xml
index e2b3a9b..66cc315 100644
--- a/en-US/Managing_Users.xml
+++ b/en-US/Managing_Users.xml
@@ -250,9 +250,9 @@ s0-s0:c0.c1023 __default__
$ /usr/sbin/getenforce
Enforcing
</screen>
- <para>
- If this is not the case, refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled.
- </para>
+<!-- <para>
+ If this is not the case, refer to <xref linkend="" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled.
+ </para> -->
</listitem>
<listitem>
<para>
diff --git a/en-US/Working_With_SELinux.xml b/en-US/Working_With_SELinux.xml
index ec7bba1..59fd331 100644
--- a/en-US/Working_With_SELinux.xml
+++ b/en-US/Working_With_SELinux.xml
@@ -3,138 +3,167 @@
]>
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux">
- <title>Working with SELinux</title>
+ <title>Working with SELinux</title>
+ <para>
+ The following sections give a brief overview of the main SELinux packages in &PRODUCT;; installing and updating packages; which log files are used; the main SELinux configuration file; enabling and disabling SELinux; SELinux modes; configuring Booleans; temporarily and persistently changing file and directory labels; overriding file system labels with the <command>mount</command> command; mounting NFS volumes; and how to preserve SELinux contexts when copying and archiving files and directories.
+ </para>
+
+ <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Packages">
+ <title>SELinux Packages</title>
+ <para>
+ In &PRODUCT; full installation, the SELinux packages are installed by default unless they are manually excluded during installation. If performing a minimal installation in text mode, the <package>policycoreutils-python</package> and the <package>policycoreutils-gui</package> package are not installed by default. Also, by default, SELinux runs in enforcing mode and the SELinux targeted policy is used. The following SELinux packages are installed on your system by default:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <package>policycoreutils</package> provides utilities such as <systemitem>restorecon</systemitem>, <systemitem>secon</systemitem>, <systemitem>setfiles</systemitem>, <systemitem>semodule</systemitem>, <systemitem>load_policy</systemitem>, and <systemitem>setsebool</systemitem>, for operating and managing SELinux.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>selinux-policy</package> provides configuration for the SELinux Reference policy. The SELinux Reference Policy is a complete SELinux policy, and is used as a basis for other policies, such as the SELinux targeted policy; refer to the Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy">SELinux Reference Policy</ulink> page for further information. This package contains the <filename>selinux-policy.conf</filename> file and RPM macros.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>selinux-policy-targeted</package> provides the SELinux targeted policy.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>libselinux</package> – provides an API for SELinux applications.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>libselinux-utils</package> provides the <systemitem>avcstat</systemitem>, <systemitem>getenforce</systemitem>, <systemitem>getsebool</systemitem>, <systemitem>matchpathcon</systemitem>, <systemitem>selinuxconlist</systemitem>, <systemitem>selinuxdefcon</systemitem>, <systemitem>selinuxenabled</systemitem>, and <systemitem>setenforce</systemitem> utilities.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>libselinux-python</package> provides Python bindings for developing SELinux applications.
+ </para>
+ </listitem>
+ </itemizedlist>
+
<para>
- The following sections give a brief overview of the main SELinux packages in &PRODUCT;, installing and updating packages, which log files are used, the main SELinux configuration file, enabling and disabling SELinux, SELinux modes, configuring Booleans, temporarily and persistently changing file and directory labels, overriding file system labels with the <command>mount</command> command, mounting NFS file systems, and how to preserve SELinux contexts when copying and archiving files and directories.
+ The following packages are not installed by default but can be optionally installed by running the <command>yum install <replaceable><package-name></replaceable></command> command:
</para>
- <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Packages">
- <title>SELinux Packages</title>
- <para>
- In &PRODUCT;, the SELinux packages are installed by default in a full installation, unless they are manually excluded during installation. If performing a minimal installation in text mode, the <package>policycoreutils-python</package> package will not be installed by default. Also, by default, SELinux targeted policy is used, and SELinux runs in enforcing mode. The following is a brief description of the main SELinux packages:
- </para>
- <para>
- <package>policycoreutils-python</package>: provides utilities such as <command>semanage</command>, <command>audit2allow</command>, <command>audit2why</command> and <command>chcat</command>, for operating and managing SELinux.
- </para>
- <para>
- <package>policycoreutils</package>: provides utilities such as <command>restorecon</command>, <command>secon</command>, <command>setfiles</command>, <command>semodule</command>, <command>load_policy</command>, and <command>setsebool</command>, for operating and managing SELinux.
- </para>
- <para>
- <package>policycoreutils-gui</package>: provides <command>system-config-selinux</command>, a graphical tool for managing SELinux.
- </para>
- <para>
- <package>selinux-policy</package>: provides the SELinux Reference Policy. The SELinux Reference Policy is a complete SELinux policy, and is used as a basis for other policies, such as the SELinux targeted policy. Refer to the Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy">SELinux Reference Policy</ulink> page for further information. The <package>selinux-policy-devel</package> package provides development tools, such as <command>/usr/share/selinux/devel/policygentool</command> and <command>/usr/share/selinux/devel/policyhelp</command>, as well as example policy files. This package was merged into the <package>selinux-policy</package> package.
- </para>
- <para>
- <package>selinux-policy-<replaceable>policy</replaceable></package>: provides SELinux policies. For targeted policy, install <package>selinux-policy-targeted</package>. For MLS, install <package>selinux-policy-mls</package>.
- </para>
- <para>
- <package>setroubleshoot-server</package>: translates denial messages, produced when access is denied by SELinux, into detailed descriptions that are viewed with <command>sealert</command> (which is provided by this package).
- </para>
- <para>
- <package>setools</package>, <package>setools-gui</package>, and <package>setools-console</package>: these packages provide the <ulink url="http://oss.tresys.com/projects/setools">Tresys Technology SETools distribution</ulink>, a number of tools and libraries for analyzing and querying policy, audit log monitoring and reporting, and file context management<footnote>
- <para>
- Brindle, Joshua. "Re: blurb for fedora setools packages" Email to Murray McAllister. 1 November 2008. Any edits or changes in this version were done by Murray McAllister.
- </para>
- </footnote>. The <package>setools</package> package is a meta-package for SETools. The <package>setools-gui</package> package provides the <command>apol</command>, <command>seaudit</command>, and <command>sediffx</command> tools. The <package>setools-console</package> package provides the <command>seaudit-report</command>, <command>sechecker</command>, <command>sediff</command>, <command>seinfo</command>, <command>sesearch</command>, <command>findcon</command>, <command>replcon</command>, and <command>indexcon</command> command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/setools">Tresys Technology SETools</ulink> page for information about these tools.
- </para>
- <para>
- <package>libselinux-utils</package>: provides the <command>avcstat</command>, <command>getenforce</command>, <command>getsebool</command>, <command>matchpathcon</command>, <command>selinuxconlist</command>, <command>selinuxdefcon</command>, <command>selinuxenabled</command>, <command>setenforce</command>, <command>togglesebool</command> tools.
- </para>
- <para>
- <package>mcstrans</package>: translates levels, such as <computeroutput>s0-s0:c0.c1023</computeroutput>, to an easier to read form, such as <computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not installed by default.
- </para>
- <para>
- To install packages in &PRODUCT;, as the Linux root user, run the <command>yum install <replaceable>package-name</replaceable></command> command. For example, to install the <package>mcstrans</package> package, run the <command>yum install mcstrans</command> command. To upgrade all installed packages in &PRODUCT;, run the <command>yum update</command> command.
- </para>
- <para>
- Refer to <ulink url="http://docs.fedoraproject.org/yum/en/">Managing Software with yum</ulink><footnote>
- <para>
- Managing Software with yum, written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and Hugo Cisneiros.
- </para>
- </footnote> for further information about using <command>yum</command> to manage packages.
- </para>
- <note>
- <para>
- In previous versions of &PRODUCT;, the <package>selinux-policy-devel</package> package is required when making a local policy module with <command>audit2allow -M</command>.
- </para>
- </note>
- </section>
-
- <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used">
- <title>Which Log File is Used</title>
- <para>
- In &PRODUCT; &PRODVER;, the <package>dbus</package>, <package>setroubleshoot-server</package> and <package>audit</package> packages are installed if packages are not removed from the default package selection.
- </para>
- <para>
- SELinux denial messages, such as the following, are written to <filename>/var/log/audit/audit.log</filename> by default:
- </para>
-
-<screen>type=AVC msg=audit(1223024155.684:49): avc: denied { getattr } for pid=2000 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=399185 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:samba_share_t:s0 tclass=file
-</screen>
- <para>
- Also, if <systemitem class="daemon">setroubleshootd</systemitem> is running, denial messages from <filename>/var/log/audit/audit.log</filename> are translated to an easier-to-read form and sent to <filename>/var/log/messages</filename>:
- </para>
-
-<screen>May 7 18:55:56 localhost setroubleshoot: SELinux is preventing httpd (httpd_t) "getattr" to /var/www/html/file1 (samba_share_t). For complete SELinux messages. run sealert -l de7e30d6-5488-466d-a606-92c9f40d316d
-</screen>
- <para>
- In &PRODUCT; &PRODVER;, <systemitem class="daemon">setroubleshootd</systemitem> no longer constantly runs as a service, however it is still used to analyze the AVC messages. Two new programs act as a method to start setroubleshoot when needed: <systemitem class="daemon">sedispatch</systemitem> and <systemitem class="daemon">seapplet</systemitem>. <systemitem class="daemon">sedispatch</systemitem> runs as part of the audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, sends a message when an AVC denial occurs, which will go straight to <systemitem class="daemon">setroubleshootd</systemitem> if it is already running, or it will start <systemitem class="daemon">setroubleshootd</systemitem> if it is not running. <systemitem class="daemon">seapplet</systemitem> is a tool which runs in the system's toolbar, waiting for dbus messages in <systemitem class="daemon">setroubleshootd</systemitem>, and will launch the notification bubble, allowing the user to r
eview the denial.
- </para>
- <para>
- Denial messages are sent to a different location, depending on which daemons are running:
- </para>
- <segmentedlist>
- <segtitle>Daemon</segtitle>
- <segtitle>Log Location</segtitle>
- <seglistitem>
- <seg>auditd on</seg>
- <seg><filename>/var/log/audit/audit.log</filename></seg>
- </seglistitem>
- <seglistitem>
- <seg>auditd off; rsyslogd on</seg>
- <seg><filename>/var/log/messages</filename></seg>
- </seglistitem>
- <seglistitem>
- <seg>rsyslogd and auditd on</seg>
- <seg><filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename></seg>
- </seglistitem>
- </segmentedlist>
- <formalpara id="form-Security-Enhanced_Linux-Which_Log_File_is_Used-Starting_Daemons_Automatically">
- <title>Starting Daemons Automatically</title>
- <para>
- To configure the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons to automatically start at boot, run the following commands as the Linux root user:
- </para>
- </formalpara>
-<screen>/sbin/chkconfig --levels 2345 auditd on
-</screen>
-
-<screen>/sbin/chkconfig --levels 2345 rsyslog on
-</screen>
- <para>
- Use the <command>service <replaceable>service-name</replaceable> status</command> command to check if these services are running, for example:
- </para>
-
+
+ <itemizedlist>
+ <listitem>
+ <para>
+ <package>selinux-policy-devel</package> provides utilities for creating a custom SELinux policy and policy modules. It also contains manual pages that describe how to configure SELinux altogether with various services.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>selinux-policy-mls</package> provides the MLS (Multi-Level Security) SELinux policy.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>setroubleshoot-server</package> translates denial messages, produced when access is denied by SELinux, into detailed descriptions that can be viewed with the <command>sealert</command> utility, also provided in this package.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>setools-console</package> provides the <ulink url="http://oss.tresys.com/projects/setools">Tresys Technology SETools distribution</ulink>, a number of utilities and libraries for analyzing and querying policy, audit log monitoring and reporting, and file context management.
+
+ <!-- <footnote>
+ <para>
+ Brindle, Joshua. "Re: blurb for fedora setools packages" Email to Murray McAllister. 1 November 2008. Any edits or changes in this version were done by Murray McAllister.
+ </para>
+ </footnote> -->
+
+ The <package>setools</package> package is a meta-package for SETools. The <package>setools-gui</package> package provides the <systemitem>apol</systemitem> and <systemitem>seaudit</systemitem> utilities. The <package>setools-console</package> package provides the <systemitem>sechecker</systemitem>, <systemitem>sediff</systemitem>, <systemitem>seinfo</systemitem>, <systemitem>sesearch</systemitem>, and <systemitem>findcon</systemitem> command-line utilities. Refer to the <ulink url="http://oss.tresys.com/projects/setools">Tresys Technology SETools</ulink> page for information about these utilities. Note that <package>setools</package> and <package>setools-gui</package> packages are available only when the Red Hat Network Optional channel is enabled. For further information, see <ulink url="https://access.redhat.com/site/support/offerings/production/scope_moredetail">Scope of Coverage Details</ulink>.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>mcstrans</package> translates levels, such as <systemitem>s0-s0:c0.c1023</systemitem>, to a form that is easier to read, such as <computeroutput>SystemLow-SystemHigh</computeroutput>.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>policycoreutils-python</package> provides utilities such as <command>semanage</command>, <command>audit2allow</command>, <command>audit2why</command>, and <command>chcat</command>, for operating and managing SELinux.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>policycoreutils-gui</package> provides <command>system-config-selinux</command>, a graphical utility for managing SELinux.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
+
+ <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used">
+ <title>Which Log File is Used</title>
+ <para>
+ In &PRODUCT;, the <package>dbus</package> and <package>audit</package> packages are installed by default, unless they are removed from the default package selection. The <package>setroubleshoot-server</package> must be installed via Yum (use the <command>yum install setroubleshoot</command> command).
+ </para>
+ <para>
+ If the <systemitem class="daemon">auditd</systemitem> daemon is running, an SELinux denial message, such as the following, is written to <filename>/var/log/audit/audit.log</filename> by default:
+ </para>
<screen>
-$ /sbin/service auditd status
-auditd (pid <replaceable>1318</replaceable>) is running...
+type=AVC msg=audit(1223024155.684:49): avc: denied { getattr } for pid=2000 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=399185 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:samba_share_t:s0 tclass=file
</screen>
- <para>
- If the above services are not running (<computeroutput><replaceable>service-name</replaceable> is stopped</computeroutput>), use the <command>service <replaceable>service-name</replaceable> start</command> command as the Linux root user to start them. For example:
- </para>
-
+ <para>
+ In addition, a message similar to the one below is written to the <filename>/var/log/message</filename> file:
+ </para>
<screen>
-# /sbin/service auditd start
-Starting auditd: [ OK ]
-</screen>
- </section>
-
+May 7 18:55:56 localhost setroubleshoot: SELinux is preventing httpd (httpd_t) "getattr" to /var/www/html/file1 (samba_share_t). For complete SELinux messages. run sealert -l de7e30d6-5488-466d-a606-92c9f40d316d
+</screen>
+ <para>
+ In &PRODUCT; &PRODVER;, <systemitem class="daemon">setroubleshootd</systemitem> no longer constantly runs as a service. However, it is still used to analyze the AVC messages. Two new programs act as a method to start <systemitem>setroubleshoot</systemitem> when needed:
+ <itemizedlist>
+ <listitem>
+ <para>
+ The <systemitem>sedispatch</systemitem> utility runs as a part of the <systemitem>audit</systemitem> subsystem. When an AVC denial message is returned, <systemitem>sedispatch</systemitem> sends a message using <systemitem>dbus</systemitem>. These messages go straight to <systemitem class="daemon">setroubleshootd</systemitem> if it is already running. If it is not running, <systemitem>sedispatch</systemitem> starts it automatically.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <systemitem>seapplet</systemitem> utility runs in the system toolbar, waiting for dbus messages in <systemitem class="daemon">setroubleshootd</systemitem>. It launches the notification bubble, allowing the user to review AVC messages.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ <procedure id="proc-Security-Enhanced_Linux-Which_Log_File_is_Used-Starting_Daemons_Automatically">
+ <title>Starting Daemons Automatically</title>
+ <para>
+ To configure the <systemitem class="daemon">auditd</systemitem> and <systemitem class="daemon">rsyslogd</systemitem> daemons to automatically start at boot, run the following commands as the root user:
+ </para>
+ <step>
+<screen><prompt>~]#</prompt> <command>chkconfig --levels 2345 auditd on</command></screen>
+<screen><prompt>~]#</prompt> <command>chkconfig --levels 2345 rsyslog on</command></screen>
+ </step>
+ <step>
+ <para>
+ Use the <command>systemctl status <replaceable>service-name</replaceable>.service</command> command to check if these services are running, for example:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>systemctl status auditd.service</command>
+auditd.service - Security Auditing Service
+ Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled)
+ Active: active (running) since Thu 2013-08-15 09:10:37 CEST; 23min ago
+</screen>
+ </step>
+ <step>
+ <para>
+ If the above services are not running (<computeroutput>Active: inactive (dead)</computeroutput>), use the <command>systemctl start <replaceable>service-name</replaceable>.service</command> command as root to start them. For example:
+ </para>
+<screen><prompt>~]#</prompt> <command>systemctl start auditd.service</command></screen>
+ </step>
+ </procedure>
+ </section>
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Main_Configuration_File">
<title>Main Configuration File</title>
<para>
The <filename>/etc/selinux/config</filename> file is the main SELinux configuration file. It controls the SELinux mode and the SELinux policy to use:
</para>
-
-<screen># This file controls the state of SELinux on the system.
+<screen>
+# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
@@ -158,14 +187,14 @@ SELINUXTYPE=targeted
<term><computeroutput>SELINUXTYPE=targeted</computeroutput></term>
<listitem>
<para>
- The <option>SELINUXTYPE</option> option sets the SELinux policy to use. Targeted policy is the default policy. Only change this option if you want to use the MLS policy. To use the MLS policy, install the <package>selinux-policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in <filename>/etc/selinux/config</filename>; and reboot your system.
+ The <option>SELINUXTYPE</option> option sets the SELinux policy to use. Targeted policy is the default policy. Only change this option if you want to use the MLS policy. For information on how to enable the MLS policy, refer to <xref linkend="enabling-mls-in-selinux"/>.
</para>
</listitem>
</varlistentry>
</variablelist>
<important>
<para>
- When systems run with SELinux in permissive or disabled mode, users have permission to label files incorrectly. Also, files created while SELinux is disabled are not labeled. This causes problems when changing to enforcing mode. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from disabled mode to permissive or enforcing mode.
+ When systems run with SELinux in permissive or disabled mode, users have permission to label fies incorrectly. Also, files created while SELinux is disabled are not labeled. This causes problems when changing to enforcing mode. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from disabled mode to permissive or enforcing mode.
</para>
</important>
</section>
@@ -173,37 +202,35 @@ SELINUXTYPE=targeted
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux">
<title>Enabling and Disabling SELinux</title>
<para>
- Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/sestatus</command> commands to check the status of SELinux. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>, <computeroutput>Permissive</computeroutput>, or <computeroutput>Disabled</computeroutput>. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput> when SELinux is enabled (SELinux policy rules are enforced):
- </para>
-
-<screen>$ /usr/sbin/getenforce
-Enforcing
-</screen>
- <para>
- The <command>getenforce</command> command returns <computeroutput>Permissive</computeroutput> when SELinux is enabled, but SELinux policy rules are not enforced, and only DAC rules are used. The <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput> if SELinux is disabled.
+ Use the <command>getenforce</command> or <command>sestatus</command> commands to check the status of SELinux. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>, <computeroutput>Permissive</computeroutput>, or <computeroutput>Disabled</computeroutput>.
</para>
<para>
The <command>sestatus</command> command returns the SELinux status and the SELinux policy being used:
</para>
-
-<screen>$ /usr/sbin/sestatus
+<screen>
+<prompt>~]$</prompt> <command>sestatus</command>
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
-Policy version: 23
+Policy version: 24
Policy from config file: targeted
</screen>
- <para>
- <computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used.
- </para>
<section id="sect-Security-Enhanced_Linux-Enabling_and_Disabling_SELinux-Enabling_SELinux">
<title>Enabling SELinux</title>
+
+ <important> <!-- 832337 -->
+ <para>
+ If the system was initially installed without SELinux, particularly the <package>selinux-policy</package> package, which was added to the system later, one additional step is necessary to enable SELinux. To make sure SELinux is initialized during system startup, the <systemitem>dracut</systemitem> utility has to be run to put SELinux awareness into the initramfs file system. Failing to do so causes SELinux not to start during system startup.
+ </para>
+ </important>
+
<para>
On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</computeroutput> option is configured in <filename>/etc/selinux/config</filename>:
</para>
-<screen># This file controls the state of SELinux on the system.
+<screen>
+# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
@@ -218,24 +245,125 @@ SELINUXTYPE=targeted
Also, the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:
</para>
-<screen>$ /usr/sbin/getenforce
+<screen>
+<prompt>~]$</prompt> <command>getenforce</command>
Disabled
</screen>
<para>
- To enable SELinux:
- </para>
- <orderedlist>
- <listitem>
- <para>
- Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</command> commands to confirm that the SELinux packages are installed. This guide assumes the following packages are installed: <package>selinux-policy-targeted</package>, <package>selinux-policy</package>, <package>libselinux</package>, <package>libselinux-python</package>, <package>libselinux-utils</package>, <package>policycoreutils</package>, <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-plugins</package>. If these packages are not installed, as the Linux root user, install them via the <command>yum install <replaceable>package-name</replaceable></command> command. The following packages are optional: <package>policycoreutils-gui</package>, <package>setroubleshoot</package>, <package>selinux-policy-devel</package>, and <package>mcstrans</package>.
- </para>
- </listitem>
- <listitem>
- <para>
- Before SELinux is enabled, each file on the file system must be labeled with an SELinux context. Before this happens, confined domains may be denied access, preventing your system from booting correctly. To prevent this, configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/etc/selinux/config</filename>:
+ Following procedure shows how to enable SELinux:
+ </para>
+ <procedure id="proc-Working_with-SELinux-Enabling_SELinux">
+ <title>Enabling SELinux</title>
+ <step>
+ <para>
+ This guide assumes that the following packages are installed:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <package>selinux-policy-targeted</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>selinux-policy</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>libselinux</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>libselinux-python</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>libselinux-utils</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>policycoreutils</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>policycoreutils-python</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>setroubleshoot</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>setroubleshoot-server</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>setroubleshoot-plugins</package>
+ </para>
+ </listitem>
+ </itemizedlist>
+ <para>
+ To confirm that the aforementioned packages are installed, use the <systemitem>rpm</systemitem> utility:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>rpm -qa | grep selinux</command>
+selinux-policy-3.12.1-136.el7.noarch
+libselinux-2.2.2-4.el7.x86_64
+selinux-policy-targeted-3.12.1-136.el7.noarch
+libselinux-utils-2.2.2-4.el7.x86_64
+libselinux-python-2.2.2-4.el7.x86_64
+</screen>
+<screen>
+<prompt>~]$</prompt> <command>rpm -qa | grep policycoreutils</command>
+policycoreutils-2.2.5-6.el7.x86_64
+policycoreutils-python-2.2.5-6.el7.x86_64
+</screen>
+<screen>
+<prompt>~]$</prompt> <command>rpm -qa | grep setroubleshoot</command>
+setroubleshoot-server-3.2.17-2.el7.x86_64
+setroubleshoot-3.2.17-2.el7.x86_64
+setroubleshoot-plugins-3.0.58-2.el7.noarch
+</screen>
+ <para>
+ If they are not installed, use the <systemitem>yum</systemitem> utility as root to install them:
+ </para>
+<screen><prompt>~]#</prompt> <command>yum install <replaceable>package_name</replaceable></command></screen>
+ <para>
+ The following packages are optional:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <package>policycoreutils-gui</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>setroubleshoot</package>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <package>mcstrans</package>
+ </para>
+ </listitem>
+ </itemizedlist>
+ </step>
+ <step>
+ <para>
+ Before SELinux is enabled, each file on the file system must be labeled with an SELinux context. Before this happens, confined domains may be denied access, preventing your system from booting correctly. To prevent this, configure <computeroutput>SELINUX=permissive</computeroutput> in the <filename>/etc/selinux/config</filename> file:
</para>
-<screen># This file controls the state of SELinux on the system.
+<screen>
+# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
@@ -246,32 +374,35 @@ SELINUX=permissive
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>reboot</command> command to restart the system. During the next boot, file systems are labeled. The label process labels all files with an SELinux context:
+ As root, restart the system. During the next boot, file systems are labeled. The label process labels all files with an SELinux context:
</para>
-
-<screen>*** Warning -- SELinux targeted policy relabel is required.
+<screen><prompt>~]#</prompt> <command>reboot</command></screen>
+<screen>
+*** Warning -- SELinux targeted policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
****
</screen>
<para>
- Each <computeroutput>*</computeroutput> character on the bottom line represents 1000 files that have been labeled. In the above example, four <computeroutput>*</computeroutput> characters represent 4000 files have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes.
+ Each <computeroutput>*</computeroutput> (asterisk) character on the bottom line represents 1000 files that have been labeled. In the above example, four <computeroutput>*</computeroutput> characters represent 4000 files have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as the Linux root user, run the <command>grep "SELinux is preventing" /var/log/messages</command> command as the Linux root user to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. Refer to <xref linkend="sect-Security-Enhanced_Linux-Troubleshooting" /> for troubleshooting information if SELinux denied access during boot.
+ In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as root, run the following command to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. Refer to <xref linkend="sect-Security-Enhanced_Linux-Troubleshooting" /> for troubleshooting information if SELinux denied access during boot.
</para>
- </listitem>
- <listitem>
+<screen><prompt>~]#</prompt> <command>grep "SELinux is preventing" /var/log/messages</command></screen>
+ </step>
+ <step>
<para>
- If there were no denial messages in <filename>/var/log/messages</filename>, configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/etc/selinux/config</filename>:
+ If there were no denial messages in the <filename>/var/log/messages</filename> file, configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/etc/selinux/config</filename>:
</para>
-<screen># This file controls the state of SELinux on the system.
+<screen>
+# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
@@ -282,69 +413,62 @@ SELINUX=enforcing
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>:
+ Reboot your system. After reboot, confirm that <command>getenforce</command> returns <computeroutput>Enforcing</computeroutput>:
</para>
-
-<screen>$ /usr/sbin/getenforce
+<screen>
+<prompt>~]$</prompt> <command>getenforce</command>
Enforcing
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/semanage login -l</command> command to view the mapping between SELinux and Linux users. The output should be as follows:
+ As root, run the following command to view the mapping between SELinux and Linux users. The output should be as follows:
</para>
-
-<screen>Login Name SELinux User MLS/MCS Range
+<screen>
+<prompt>~]#</prompt> <command>semanage login -l</command>
+
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
- </listitem>
- </orderedlist>
+ </step>
+ </procedure>
<para>
- If this is not the case, run the following commands as the Linux root user to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-user<replaceable> username</replaceable> is already defined</computeroutput> warnings if they occur, where <replaceable>username</replaceable> can be <computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</computeroutput>, or <computeroutput>xguest_u</computeroutput>:
+ If this is not the case, run the following commands as root to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-user<replaceable> username</replaceable> is already defined</computeroutput> warnings if they occur, where <replaceable>username</replaceable> can be <systemitem>unconfined_u</systemitem>, <systemitem>guest_u</systemitem>, or <systemitem>xguest_u</systemitem>:
</para>
- <orderedlist>
- <listitem>
-
-
-<screen>/usr/sbin/semanage user -a -S targeted -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
-</screen>
-
- </listitem>
- <listitem>
-
-
-<screen>/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 __default__
-</screen>
-
- </listitem>
- <listitem>
-
-
-<screen>/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 root
-</screen>
-
- </listitem>
- <listitem>
-
-
-<screen>/usr/sbin/semanage user -a -S targeted -P user -R guest_r guest_u
-</screen>
-
- </listitem>
- <listitem>
-
-
-<screen>/usr/sbin/semanage user -a -S targeted -P user -R xguest_r xguest_u
-</screen>
-
- </listitem>
- </orderedlist>
+ <procedure id="proc-Working_with_SELinux-Fixing-user-mappings">
+ <title>Fixing User Mappings</title>
+ <step>
+ <para>
+<screen><prompt>~]#</prompt> <command>semanage user -a -S targeted -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u</command></screen>
+ </para>
+ </step>
+ <step>
+ <para>
+<screen><prompt>~]#</prompt> <command>semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 __default__</command></screen>
+ </para>
+ </step>
+ <step>
+ <para>
+<screen><prompt>~]#</prompt> <command>semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 root</command></screen>
+ </para>
+ </step>
+ <step>
+ <para>
+<screen><prompt>~]#</prompt> <command>semanage user -a -S targeted -P user -R guest_r guest_u</command></screen>
+ </para>
+ </step>
+ <step>
+ <para>
+<screen><prompt>~]#</prompt> <command>semanage user -a -S targeted -P user -R xguest_r xguest_u</command></screen>
+ </para>
+ </step>
+ </procedure>
<important>
<para>
When systems run with SELinux in permissive or disabled mode, users have permission to label files incorrectly. Also, files created while SELinux is disabled are not labeled. This causes problems when changing to enforcing mode. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from disabled mode to permissive or enforcing mode.
@@ -355,10 +479,11 @@ system_u system_u s0-s0:c0.c1023
<section id="sect-Security-Enhanced_Linux-Enabling_and_Disabling_SELinux-Disabling_SELinux">
<title>Disabling SELinux</title>
<para>
- To disable SELinux, configure <option>SELINUX=disabled</option> in <filename>/etc/selinux/config</filename>:
+ To disable SELinux, configure <option>SELINUX=disabled</option> in the <filename>/etc/selinux/config</filename> file:
</para>
-<screen># This file controls the state of SELinux on the system.
+<screen>
+# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
@@ -373,236 +498,239 @@ SELINUXTYPE=targeted
Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:
</para>
-<screen>$ /usr/sbin/getenforce
+<screen>
+<prompt>~]$</prompt> <command>getenforce</command>
Disabled
</screen>
</section>
</section>
-
- <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Modes">
- <title>SELinux Modes</title>
- <para>
- SELinux has three modes:
- </para>
- <itemizedlist>
- <listitem>
- <para>
- Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules.
- </para>
- </listitem>
- <listitem>
- <para>
- Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode.
- </para>
- </listitem>
- <listitem>
- <para>
- Disabled: SELinux is disabled. Only DAC rules are used.
- </para>
- </listitem>
- </itemizedlist>
- <para>
- Use the <command>/usr/sbin/setenforce</command> command to change between enforcing and permissive mode. Changes made with <command>/usr/sbin/setenforce</command> do not persist across reboots. To change to enforcing mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</command> command. To change to permissive mode, run the <command>/usr/sbin/setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</command> command to view the current SELinux mode.
- </para>
- <para>
- Persistent mode changes are covered in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />.
- </para>
- </section>
-
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans">
<title>Booleans</title>
<para>
- Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy.
+ Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS volumes, without reloading or recompiling SELinux policy.
</para>
<section id="sect-Security-Enhanced_Linux-Booleans-Listing_Booleans">
<title>Listing Booleans</title>
<para>
- For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>semanage boolean -l</command> command as the Linux root user. The following example does not list all Booleans:
+ For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>semanage boolean -l</command> command as the Linux root user. The following example does not list all Booleans and the output is shortened for brevity:
</para>
-
-<screen># /usr/sbin/semanage boolean -l
-SELinux boolean Description
-ftp_home_dir -> off Allow ftp to read and write files in the user home directories
-xen_use_nfs -> off Allow xen to manage nfs files
-xguest_connect_network -> on Allow xguest to configure Network Manager
+<screen><prompt>~]#</prompt> <command>semanage boolean -l</command>
+SELinux boolean State Default Description
+
+ftp_home_dir (off , off) Determine whether ftpd can read...
+smartmon_3ware (off , off) Determine whether smartmon can...
+mpd_enable_homedirs (off , off) Determine whether mpd can traverse...
</screen>
<para>
The <computeroutput>SELinux boolean</computeroutput> column lists Boolean names. The <computeroutput>Description</computeroutput> column lists whether the Booleans are on or off, and what they do.
</para>
<para>
- In the following example, the <computeroutput>ftp_home_dir</computeroutput> Boolean is off, preventing the FTP daemon (<systemitem class="daemon">vsftpd</systemitem>) from reading and writing to files in user home directories:
+ In the following example, the <systemitem>ftp_home_dir</systemitem> Boolean is off, preventing the FTP daemon (<systemitem class="daemon">vsftpd</systemitem>) from reading and writing to files in user home directories:
</para>
-<screen>ftp_home_dir -> off Allow ftp to read and write files in the user home directories
+<screen>ftp_home_dir (off , off) Determine whether ftpd can read...
</screen>
<para>
The <command>getsebool -a</command> command lists Booleans, whether they are on or off, but does not give a description of each one. The following example does not list all Booleans:
</para>
-<screen>$ /usr/sbin/getsebool -a
-allow_console_login --> off
-allow_cvs_read_shadow --> off
-allow_daemons_dump_core --> on
+<screen><prompt>~]$</prompt> <command>getsebool -a</command>
+cvs_read_shadow --> off
+daemons_dump_core --> on
+ftp_home_dir --> off
</screen>
<para>
Run the <command>getsebool <replaceable>boolean-name</replaceable></command> command to only list the status of the <replaceable>boolean-name</replaceable> Boolean:
</para>
-<screen>$ /usr/sbin/getsebool allow_console_login
-allow_console_login --> off
+<screen><prompt>~]$</prompt> <command>getsebool cvs_read_shadow</command>
+cvs_read_shadow --> off
</screen>
<para>
Use a space-separated list to list multiple Booleans:
</para>
-<screen>$ getsebool allow_console_login allow_cvs_read_shadow allow_daemons_dump_core
-allow_console_login --> off
-allow_cvs_read_shadow --> off
-allow_daemons_dump_core --> on
+<screen><prompt>~]$</prompt> <command>getsebool cvs_read_shadow daemons_dump_core ftp_home_dir</command>
+cvs_read_shadow --> off
+daemons_dump_core --> on
+ftp_home_dir --> off
</screen>
</section>
<section id="sect-Security-Enhanced_Linux-Booleans-Configuring_Booleans">
<title>Configuring Booleans</title>
<para>
- The <command>setsebool <replaceable>boolean-name</replaceable> <replaceable>x</replaceable></command> command turns Booleans on or off, where <replaceable>boolean-name</replaceable> is a Boolean name, and <replaceable>x</replaceable> is either <option>on</option> to turn the Boolean on, or <option>off</option> to turn it off.
- </para>
- <para>
- The following example demonstrates configuring the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:
- </para>
- <orderedlist>
- <listitem>
+ Run the <systemitem>setsebool</systemitem> utility in the <command>setsebool <replaceable>boolean_name</replaceable> on/off</command> form to enable or disable Booleans.
+ </para>
+ <para>
+ The following example demonstrates configuring the <systemitem>httpd_can_network_connect_db</systemitem> Boolean:
+ </para>
+ <procedure id="proc-configuring-booleans">
+ <title>Configuring Booleans</title>
+ <step>
<para>
- By default, the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers:
+ By default, the <systemitem>httpd_can_network_connect_db</systemitem> Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers:
</para>
-
-<screen>$ /usr/sbin/getsebool httpd_can_network_connect_db
+<screen>
+<prompt>~]$</prompt> <command>getsebool httpd_can_network_connect_db</command>
httpd_can_network_connect_db --> off
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, run the <command>setsebool httpd_can_network_connect_db on</command> command as the Linux root user.
- </para>
- </listitem>
- <listitem>
+ To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, run the following command as root:
+ </para>
+<screen><prompt>~]#</prompt> <command>setsebool httpd_can_network_connect_db on</command></screen>
+ </step>
+ <step>
<para>
- Use the <command>getsebool httpd_can_network_connect_db</command> command to verify the Boolean is turned on:
+ Use the <systemitem>getsebool</systemitem> utility to verify the Boolean has been enabled:
</para>
-
-<screen>$ /usr/sbin/getsebool httpd_can_network_connect_db
+<screen>
+<prompt>~]$</prompt> <command>getsebool httpd_can_network_connect_db</command>
httpd_can_network_connect_db --> on
</screen>
<para>
This allows Apache HTTP Server scripts and modules to connect to database servers.
</para>
- </listitem>
- <listitem>
- <para>
- This change is not persistent across reboots. To make changes persistent across reboots, run the <command>setsebool -P <replaceable>boolean-name</replaceable> on</command> command as the Linux root user:
- </para>
-
-<screen># /usr/sbin/setsebool -P httpd_can_network_connect_db on
-</screen>
- </listitem>
- <listitem>
- <para>
- To temporarily revert to the default behavior, as the Linux root user, run the <command>setsebool httpd_can_network_connect_db off</command> command. For changes that persist across reboots, run the <command>setsebool -P httpd_can_network_connect_db off</command> command.
- </para>
- </listitem>
- </orderedlist>
- </section>
+ </step>
+ <step>
+ <para>
+ This change is not persistent across reboots. To make changes persistent across reboots, run the <command>setsebool -P <replaceable>boolean-name</replaceable> on</command> command as root:<footnote><para>To temporarily revert to the default behavior, as the Linux root user, run the <command>setsebool httpd_can_network_connect_db off</command> command. For changes that persist across reboots, run the <command>setsebool -P httpd_can_network_connect_db off</command> command.</para></footnote>
+ </para>
+<screen><prompt>~]#</prompt> <command>setsebool -P httpd_can_network_connect_db on</command>
+ </screen>
+ </step>
+ </procedure>
+ </section>
+ <section id="sect-Security-Enhanced_Linux-Booleans-Shell_Auto-Completion">
+ <title>Shell Auto-Completion</title>
+ <para>
+ It is possible to use shell auto-completion with the <systemitem>getsebool</systemitem>, <systemitem>setsebool</systemitem>, and <systemitem>semanage</systemitem> utilities. Use the auto-completion with <systemitem>getsebool</systemitem> and <systemitem>setsebool</systemitem> to complete both command-line parameters and Booleans. To list only the command-line parameters, add the hyphen character ("-") after the command name and hit the <keycap>Tab</keycap> key:
+ </para>
+ <!-- <screen><prompt>~]$</prompt> getsebool -[Tab]
+-a
+ </screen>-->
+ <screen><prompt>~]#</prompt> setsebool -[Tab]
+-P
+</screen>
+ <para>
+ To complete a Boolean, start writing the Boolean name and then hit <keycap>Tab</keycap>:
+ </para>
+<screen><prompt>~]$</prompt> getsebool samba_[Tab]
+samba_create_home_dirs samba_export_all_ro samba_run_unconfined
+samba_domain_controller samba_export_all_rw samba_share_fusefs
+samba_enable_home_dirs samba_portmapper samba_share_nfs
+</screen>
+<screen><prompt>~]#</prompt> setsebool -P virt_use_[Tab]
+virt_use_comm virt_use_nfs virt_use_sanlock
+virt_use_execmem virt_use_rawip virt_use_usb
+virt_use_fusefs virt_use_samba virt_use_xserver
+</screen>
+ <para>
+ The <systemitem>semanage</systemitem> utility is used with several command-line arguments that are completed one by one. The first argument of a <command>semanage</command> command is an option, which specifies what part of SELinux policy is managed:
+ </para>
+ <screen><prompt>~]#</prompt> semanage [Tab]
+boolean export import login node port
+dontaudit fcontext interface module permissive user
+</screen>
+ <para>
+ Then, one or more command-line parameters follow:
+ </para>
+<screen><prompt>~]#</prompt> semanage fcontext -[Tab]
+-a -D --equal --help -m -o
+--add --delete -f -l --modify -S
+-C --deleteall --ftype --list -n -t
+-d -e -h --locallist --noheading --type
+</screen>
+ <para>
+ Finally, complete the name of a particular SELinux entry, such as a Boolean, SELinux user, domain, or another. Start typing the entry and hit <keycap>Tab</keycap>:
+ </para>
+ <screen><prompt>~]#</prompt> <command></command>semanage fcontext -a -t samba<tab>
+samba_etc_t samba_secrets_t
+sambagui_exec_t samba_share_t
+samba_initrc_exec_t samba_unconfined_script_exec_t
+samba_log_t samba_unit_file_t
+samba_net_exec_t
+ </screen>
+ <para>
+ Command-line parameters can be chained in a command:
+<screen><prompt>~]#</prompt> semanage port -a -t http_port_t -p tcp 81</screen>
+ </para>
+ </section>
- <section id="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS">
+ <!--<section id="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS">
<title>Booleans for NFS and CIFS</title>
<para>
- By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the <computeroutput>cifs_t</computeroutput> type.
+ By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the <systemitem>nfs_t</systemitem> type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the <systemitem>cifs_t</systemitem> type.
</para>
<para>
- Depending on policy configuration, services may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> or <computeroutput>cifs_t</computeroutput> types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be turned on or off to control which services are allowed to access the <computeroutput>nfs_t</computeroutput> and <computeroutput>cifs_t</computeroutput> types.
+ Depending on policy configuration, services may not be able to read files labeled with the <systemitem>nfs_t</systemitem> or <systemitem>cifs_t</systemitem> types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be enabled or disabled to control which services are allowed to access the <systemitem>nfs_t</systemitem> and <systemitem>cifs_t</systemitem> types.
</para>
<para>
- The <command>setsebool</command> and <command>semanage</command> commands must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-Apache_HTTP_Server">
- <title>Apache HTTP Server</title>
+ The <command>setsebool</command> and <command>semanage</command> commands must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots.
+ </para>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-Apache_HTTP_Server">Apache HTTP Server</bridgehead>
<para>
- To allow access to NFS file systems (files labeled with the <computeroutput>nfs_t</computeroutput> type):
+ To allow access to NFS volumes (files labeled with the <systemitem>nfs_t</systemitem> type):
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P httpd_use_nfs on</command>
- </para>
+ <screen>~]# <command>setsebool -P httpd_use_nfs on</command>
+ </screen>
<para>
- To allow access to Samba file systems (files labeled with the <computeroutput>cifs_t</computeroutput> type):
+ To allow access to Samba file systems (files labeled with the <systemitem>cifs_t</systemitem> type):
</para>
- <para>
- <command>/usr/sbin/setsebool -P httpd_use_cifs on</command>
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-Samba">
- <title>Samba</title>
+ <screen>~]# <command>setsebool -P httpd_use_cifs on</command>
+ </screen>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-Samba">Samba</bridgehead>
<para>
- To export NFS file systems:
+ To export NFS volumes:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P samba_share_nfs on</command>
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-FTP_vsftpd">
- <title>FTP (<systemitem class="daemon">vsftpd</systemitem>)</title>
+ <screen>~]# <command>setsebool -P samba_share_nfs on</command>
+ </screen>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-FTP_vsftpd">FTP (<systemitem class="daemon">vsftpd</systemitem>)</bridgehead>
<para>
- To allow access to NFS file systems:
+ To allow access to NFS volumes:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/setsebool -P allow_ftpd_use_nfs on</command>
- </para>
+ <screen>~]# <command>setsebool -P ftpd_use_nfs on</command>
+ </screen>
<para>
To allow access to Samba file systems:
</para>
- <para>
- <command>/usr/sbin/setsebool -P allow_ftpd_use_cifs on</command>
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-Other_Services">
- <title>Other Services</title>
+ <screen>~]# <command>setsebool -P ftpd_use_cifs on</command>
+ </screen>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Booleans_for_NFS_and_CIFS-Other_Services">Other Services</bridgehead>
<para>
For a list of NFS related Booleans for other services:
</para>
- </formalpara>
- <para>
- <command>/usr/sbin/semanage boolean -l | grep nfs</command>
- </para>
+ <screen>~]# <command>semanage boolean -l | grep nfs</command>
+ </screen>
<para>
For a list of Samba related Booleans for other services:
</para>
- <para>
- <command>/usr/sbin/semanage boolean -l | grep cifs</command>
- </para>
+ <screen>~]# <command>semanage boolean -l | grep cifs</command>
+ </screen>
<note>
<para>
- These Booleans exist in SELinux policy as shipped with &PRODUCT; &PRODVER;. They may not exist in policy shipped with other versions of &PRODUCT; or other operating systems.
+ These Booleans exist in SELinux policy as shipped with &PRODUCT; &PRODVER;. They may not exist in policy shipped with other versions of &PRODUCT; or other operating systems.
</para>
</note>
- <para>
- Refer to the SELinux Managing Confined Services Guide at <ulink url="http://docs.fedoraproject.org"></ulink> for more information regarding SELinux Booleans.
- </para>
- </section>
+ </section>-->
</section>
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Contexts_Labeling_Files">
- <title>SELinux Contexts - Labeling Files</title>
+ <title>SELinux Contexts – Labeling Files</title>
<para>
On systems running SELinux, all processes and files are labeled in a way that represents security-relevant information. This information is called the SELinux context. For files, this is viewed using the <command>ls -Z</command> command:
</para>
-<screen>$ ls -Z file1
+<screen><prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
</screen>
<para>
- In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. On DAC systems, access is controlled based on Linux user and group IDs. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first.
+ In this example, SELinux provides a user (<systemitem>unconfined_u</systemitem>), a role (<systemitem>object_r</systemitem>), a type (<systemitem>user_home_t</systemitem>), and a level (<systemitem>s0</systemitem>). This information is used to make access control decisions. On DAC systems, access is controlled based on Linux user and group IDs. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first.
</para>
<para>
There are multiple commands for managing the SELinux context for files, such as <command>chcon</command>, <command>semanage fcontext</command>, and <command>restorecon</command>.
@@ -610,121 +738,122 @@ httpd_can_network_connect_db --> on
<section id="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Temporary_Changes_chcon">
<title>Temporary Changes: chcon</title>
<para>
- The <command>chcon</command> command changes the SELinux context for files. However, changes made with the <command>chcon</command> command do not survive a file system relabel, or the execution of the <command>/sbin/restorecon</command> command. SELinux policy controls whether users are able to modify the SELinux context for any given file. When using <command>chcon</command>, users provide all or part of the SELinux context to change. An incorrect file type is a common cause of SELinux denying access.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Temporary_Changes_chcon-Quick_Reference">
- <title>Quick Reference</title>
+ The <command>chcon</command> command changes the SELinux context for files. However, changes made with the <command>chcon</command> command do not survive a file system relabel, or the execution of the <command>restorecon</command> command. SELinux policy controls whether users are able to modify the SELinux context for any given file. When using <command>chcon</command>, users provide all or part of the SELinux context to change. An incorrect file type is a common cause of SELinux denying access.
+ </para>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Temporary_Changes_chcon-Quick_Reference">Quick Reference</bridgehead>
<para>
<itemizedlist>
<listitem>
<para>
- Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-name</replaceable></command> command to change the file type, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-name</replaceable> is a file or directory name.
- </para>
+ Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-name</replaceable></command> command to change the file type, where <replaceable>type</replaceable> is an SELinux type, such as <systemitem>httpd_sys_content_t</systemitem>, and <replaceable>file-name</replaceable> is a file or directory name:
+ </para>
+<screen><prompt>~]$</prompt> <command>chcon -t httpd_sys_content_t <replaceable>file-name</replaceable></command></screen>
</listitem>
<listitem>
<para>
- Run the <command>chcon -R -t <replaceable>type</replaceable> <replaceable>directory-name</replaceable></command> command to change the type of the directory and its contents, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>directory-name</replaceable> is a directory name.
- </para>
+ Run the <command>chcon -R -t <replaceable>type</replaceable> <replaceable>directory-name</replaceable></command> command to change the type of the directory and its contents, where <replaceable>type</replaceable> is an SELinux type, such as <systemitem>httpd_sys_content_t</systemitem>, and <replaceable>directory-name</replaceable> is a directory name:
+ </para>
+<screen><prompt>~]$</prompt> <command>chcon -R -t httpd_sys_content_t <replaceable>directory-name</replaceable></command></screen>
</listitem>
</itemizedlist>
</para>
- </formalpara>
- <formalpara id="form-Security-Enhanced_Linux-Temporary_Changes_chcon-Changing_a_Files_or_Directorys_Type">
- <title>Changing a File's or Directory's Type</title>
- <para>
- The following example demonstrates changing the type, and no other attributes of the SELinux context:
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
+
+ <procedure id="proc-Security-Enhanced_Linux-Temporary_Changes_chcon-Changing_a_Files_or_Directorys_Type">
+ <title>Changing a File's or Directory's Type</title>
+ <para>
+ The following procedure demonstrates changing the type, and no other attributes of the SELinux context. The example in this section works the same for directories, for example, if <filename>file1</filename> was a directory.
+ </para>
+ <step>
<para>
- Run the <command>cd</command> command without arguments to change into your home directory.
- </para>
- </listitem>
- <listitem>
+ Change into your home directory.
+ </para>
+ </step>
+ <step>
<para>
- Run the <command>touch file1</command> command to create a new file. Use the <command>ls -Z file1</command> command to view the SELinux context for <filename>file1</filename>:
+ Create a new file and view its SELinux context:
</para>
-
-<screen>$ ls -Z file1
+<screen><prompt>~]$</prompt> <command>touch file1</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
</screen>
<para>
- In this example, the SELinux context for <filename>file1</filename> includes the SELinux <computeroutput>unconfined_u</computeroutput> user, <computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</computeroutput> type, and the <computeroutput>s0</computeroutput> level. For a description of each part of the SELinux context, refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts" />.
+ In this example, the SELinux context for <filename>file1</filename> includes the SELinux <systemitem>unconfined_u</systemitem> user, <systemitem>object_r</systemitem> role, <systemitem>user_home_t</systemitem> type, and the <systemitem>s0</systemitem> level. For a description of each part of the SELinux context, see <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts" />.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Run the <command>chcon -t samba_share_t file1</command> command to change the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</option> option only changes the type. View the change with <command>ls -Z file1</command>:
+ Run the following command to change the type to <systemitem>samba_share_t</systemitem>. The <option>-t</option> option only changes the type. Then view the change:
</para>
-
-<screen>$ ls -Z file1
+<screen><prompt>~]$</prompt> <command>chcon -t samba_share_t file1</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z file1 </command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:samba_share_t:s0 file1
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Use the <command>/sbin/restorecon -v file1</command> command to restore the SELinux context for the <filename>file1</filename> file. Use the <option>-v</option> option to view what changes:
+ Use the following command to restore the SELinux context for the <filename>file1</filename> file. Use the <option>-v</option> option to view what changes:
</para>
-
-<screen>$ /sbin/restorecon -v file1
+<screen><prompt>~]$</prompt> <command>restorecon -v file1</command>
restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:user_home_t:s0
</screen>
<para>
- In this example, the previous type, <computeroutput>samba_share_t</computeroutput>, is restored to the correct, <computeroutput>user_home_t</computeroutput> type. When using targeted policy (the default SELinux policy in &PRODUCT; &PRODVER;), the <command>/sbin/restorecon</command> command reads the files in the <filename>/etc/selinux/targeted/contexts/files/</filename> directory, to see which SELinux context files should have.
+ In this example, the previous type, <systemitem>samba_share_t</systemitem>, is restored to the correct, <systemitem>user_home_t</systemitem> type. When using targeted policy (the default SELinux policy in &PRODUCT;), the <command>restorecon</command> command reads the files in the <filename>/etc/selinux/targeted/contexts/files/</filename> directory, to see which SELinux context files should have.
</para>
- </listitem>
- </orderedlist>
- <para>
- The example in this section works the same for directories, for example, if <filename>file1</filename> was a directory.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Temporary_Changes_chcon-Changing_a_Directory_and_its_Contents_Types">
- <title>Changing a Directory and its Contents Types</title>
- <para>
- The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by the Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
+ </step>
+ </procedure>
+
+ <procedure id="proc-Security-Enhanced_Linux-Temporary_Changes_chcon-Changing_a_Directory_and_its_Contents_Types">
+ <title>Changing a Directory and its Contents Types</title>
+ <para>
+ The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by the Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):
+ </para>
+ <step>
<para>
- As the Linux root user, run the <command>mkdir /web</command> command to create a new directory, and then the <command>touch /web/file{1,2,3}</command> command to create 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). The <filename>/web/</filename> directory and files in it are labeled with the <computeroutput>default_t</computeroutput> type:
+ As the root user, create a new <filename class="directory">/mkdir/</filename>directory and then 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>) within this directory. The <filename class="directory">/web/</filename> directory and files in it are labeled with the <systemitem>default_t</systemitem> type:
</para>
-
-<screen># ls -dZ /web
+<screen><prompt>~]#</prompt> <command>mkdir /web</command></screen>
+<screen><prompt>~]#</prompt> <command>touch /web/file{1,2,3}</command></screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -dZ /web</command>
drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web
-# ls -lZ /web
+</screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -lZ /web</command>
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /web/</command> command to change the type of the <filename>/web/</filename> directory (and its contents) to <computeroutput>httpd_sys_content_t</computeroutput>:
+ As root, run the following command to change the type of the <filename class="directory">/web/</filename> directory (and its contents) to <systemitem>httpd_sys_content_t</systemitem>:
</para>
-<screen># chcon -R -t httpd_sys_content_t /web/
-# ls -dZ /web/
+<screen><prompt>~]#</prompt> <command>chcon -R -t httpd_sys_content_t /web/</command></screen>
+<screen><prompt>~]#</prompt> <command>ls -dZ /web/</command>
drwxr-xr-x root root unconfined_u:object_r:httpd_sys_content_t:s0 /web/
-# ls -lZ /web/
+</screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -lZ /web/</command>
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</command> command to restore the default SELinux contexts:
+ To restore the default SELinux contexts, use the <systemitem>restorecon</systemitem> utility as root:
</para>
-
-<screen># /sbin/restorecon -R -v /web/
+<screen><prompt>~]#</prompt> <command>restorecon -R -v /web/</command>
restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /web/file2 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /web/file3 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
restorecon reset /web/file1 context unconfined_u:object_r:httpd_sys_content_t:s0->system_u:object_r:default_t:s0
</screen>
- </listitem>
- </orderedlist>
+ </step>
+ </procedure>
<para>
Refer to the <citerefentry><refentrytitle>chcon</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page for further information about <command>chcon</command>.
</para>
@@ -738,243 +867,288 @@ restorecon reset /web/file1 context unconfined_u:object_r:httpd_sys_content_t:s0
<section id="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext">
<title>Persistent Changes: semanage fcontext</title>
<para>
- The <command>/usr/sbin/semanage fcontext</command> command changes the SELinux context for files. When using targeted policy, changes made with this command are added to the <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename> file if the changes are to files that exists in <filename>file_contexts</filename>, or are added to <filename>file_contexts.local</filename> for new files and directories, such as creating a <filename>/web/</filename> directory. <command>setfiles</command>, which is used when a file system is relabeled, and <command>/sbin/restorecon</command>, which restores the default SELinux contexts, read these files. This means that changes made by <command>/usr/sbin/semanage fcontext</command> are persistent, even if the file system is relabeled. SELinux policy controls whether users are able to modify the SELinux context for any given file.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Quick_Reference">
- <title>Quick Reference</title>
- <para>
- To make SELinux context changes that survive a file system relabel:
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
- <para>
- Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, remembering to use the full path to the file or directory.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command to apply the context changes.
- </para>
- </listitem>
- </orderedlist>
- <formalpara id="form-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Changing_a_Files_Type">
- <title>Changing a File's Type</title>
- <para>
- The following example demonstrates changing a file's type, and no other attributes of the SELinux context:
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
- <para>
- As the Linux root user, run the <command>touch /etc/file1</command> command to create a new file. By default, newly-created files in the <filename>/etc/</filename> directory are labeled with the <computeroutput>etc_t</computeroutput> type:
- </para>
-
-<screen># ls -Z /etc/file1
+ The <command>semanage fcontext</command> command is used to change the SELinux context of files. When using targeted policy, changes are written to files located in the <filename class="directory">/etc/selinux/targeted/contexts/files/</filename> directory:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ The <filename>file_contexts</filename> file specifies default contexts for many files, as well as contexts updated via <command>semanage fcontext</command>.
+ </para>
+ <para>
+ <remark>Does file_contexts come with the SELinux policy?</remark>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <filename>file_contexts.local</filename> file stores contexts to newly created files and directories not found in <filename>file_contexts</filename>.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <para>
+ Two utilities read these files. The <systemitem>setfiles</systemitem> utility is used when a file system is relabeled and the <systemitem>restorecon</systemitem> utility restores the default SELinux contexts. This means that changes made by <command>semanage fcontext</command> are persistent, even if the file system is relabeled. SELinux policy controls whether users are able to modify the SELinux context for any given file.
+ </para>
+ <bridgehead renderas="sect2" id="brid-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Quick_Reference">Quick Reference</bridgehead>
+ <para>
+ To make SELinux context changes that survive a file system relabel:
+ </para>
+ <para>
+ <orderedlist>
+ <listitem>
+ <para>
+ Run the following command, remembering to use the full path to the file or directory:
+ </para>
+<screen><prompt>~]#</prompt> <command>semanage fcontext -a <replaceable>options</replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command></screen>
+ </listitem>
+ <listitem>
+ <para>
+ Use the <systemitem>restorecon</systemitem> utility to apply the context changes:
+ </para>
+<screen><prompt>~]#</prompt> <command>restorecon -v <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command></screen>
+ </listitem>
+ </orderedlist>
+ </para>
+ <procedure id="proc-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Changing_a_Files_Type">
+ <title>Changing a File's or Directory 's Type</title>
+ <para>
+ The following example demonstrates changing a file's type, and no other attributes of the SELinux context. This example works the same for directories, for instance if <filename>file1</filename> was a directory.
+ </para>
+ <step>
+ <para>
+ As the root user, create a new file in the <filename class="directory">/etc/</filename> directory. By default, newly-created files in <filename class="directory">/etc/</filename> are labeled with the <systemitem>etc_t</systemitem> type:
+ </para>
+<screen><prompt>~]#</prompt> <command>touch /etc/file1</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /etc/file1</command>
-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1
</screen>
- </listitem>
- <listitem>
+ <para>
+ To list information about a directory, use the following command:
+ </para>
+<screen><prompt>~]$</prompt> <command>ls -dZ <replaceable>directory_name</replaceable></command></screen>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>samba_share_t</computeroutput>). Note: running this command does not directly change the type - <filename>file1</filename> is still labeled with the <computeroutput>etc_t</computeroutput> type:
+ As root, run the following command to change the <filename>file1</filename> type to <systemitem>samba_share_t</systemitem>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<systemitem>samba_share_t</systemitem>). Note that running this command does not directly change the type; <filename>file1</filename> is still labeled with the <systemitem>etc_t</systemitem> type:
</para>
-
-<screen># /usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1
-# ls -Z /etc/file1
+<screen><prompt>~]#</prompt> <command>semanage fcontext -a -t samba_share_t /etc/file1</command></screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -Z /etc/file1</command>
-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1
</screen>
<para>
- The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:
+ The <command>semanage fcontext -a -t samba_share_t /etc/file1</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:
</para>
-
<screen>/etc/file1 unconfined_u:object_r:samba_share_t:s0
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>samba_share_t</computeroutput>:
+ As root, use the <systemitem>restorecon</systemitem> utility to change the type. Because <systemitem>semanage</systemitem> added an entry to <filename>file.contexts.local</filename> for <filename>/etc/file1</filename>, <systemitem>restorecon</systemitem> changes the type to <systemitem>samba_share_t</systemitem>:
</para>
-
-<screen># /sbin/restorecon -v /etc/file1
+<screen>
+<prompt>~]#</prompt> <command>restorecon -v /etc/file1</command>
restorecon reset /etc/file1 context unconfined_u:object_r:etc_t:s0->system_u:object_r:samba_share_t:s0
</screen>
- </listitem>
- <listitem>
+ </step>
+ <!-- as per RT#122301
+ <step>
<para>
As the Linux root user, run the <command>rm -i /etc/file1</command> command to remove <filename>file1</filename>.
- </para>
- </listitem>
- <listitem>
+ </para>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/file1</command> command to remove the context added for <filename>/etc/file1</filename>. When the context is removed, running <command>restorecon</command> changes the type to <computeroutput>etc_t</computeroutput>, rather than <computeroutput>samba_share_t</computeroutput>.
+ As the Linux root user, run the <command>semanage fcontext -d /etc/file1</command> command to remove the context added for <filename>/etc/file1</filename>.
</para>
- </listitem>
- </orderedlist>
- <formalpara id="form-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Changing_a_Directorys_Type">
- <title>Changing a Directory's Type</title>
- <para>
- The following example demonstrates creating a new directory and changing that directory's file type, to a type used by Apache HTTP Server:
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
+ </step>-->
+ </procedure>
+
+ <!-- as per RT#122301
+ <procedure id="proc-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Changing_a_Directorys_Type">
+ <title>Changing a Directory's Type</title>
+ <para>
+ The following example demonstrates creating a new directory and changing that directory's file type, to a type used by Apache HTTP Server:
+ </para>
+ <step>
<para>
- As the Linux root user, run the <command>mkdir /web</command> command to create a new directory. This directory is labeled with the <computeroutput>default_t</computeroutput> type:
+ As the Linux root user, run the <command>mkdir /web</command> command to create a new directory. This directory is labeled with the <systemitem>default_t</systemitem> type:
</para>
-<screen># ls -dZ /web
+<screen>~]# <command>ls -dZ /web</command>
drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web
</screen>
<para>
The <command>ls</command> <option>-d</option> option makes <command>ls</command> list information about a directory, rather than its contents, and the <option>-Z</option> option makes <command>ls</command> display the SELinux context (in this example, <computeroutput>unconfined_u:object_r:default_t:s0</computeroutput>).
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command to change the <filename>/web/</filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>httpd_sys_content_t</computeroutput>). Note: running this command does not directly change the type - <filename>/web/</filename> is still labeled with the <computeroutput>default_t</computeroutput> type:
+ As the Linux root user, run the <command>semanage fcontext -a -t httpd_sys_content_t /web</command> command to change the <filename>/web/</filename> type to <systemitem>httpd_sys_content_t</systemitem>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<systemitem>httpd_sys_content_t</systemitem>). Note that running this command does not directly change the type; <filename>/web/</filename> is still labeled with the <systemitem>default_t</systemitem> type:
</para>
-<screen># /usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web
-# ls -dZ /web
+<screen>~]# <command>semanage fcontext -a -t httpd_sys_content_t /web</command>
+~]# <command>ls -dZ /web</command>
drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web
</screen>
<para>
- The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command adds the following entry to <command>/etc/selinux/targeted/contexts/files/file_contexts.local</command>:
+ The <command>semanage fcontext -a -t httpd_sys_content_t /web</command> command adds the following entry to <command>/etc/selinux/targeted/contexts/files/file_contexts.local</command>:
</para>
<screen>/web unconfined_u:object_r:httpd_sys_content_t:s0
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/web</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>httpd_sys_content_t</computeroutput>:
+ As the Linux root user, run the <command>restorecon -v /web</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/web</filename>, the <command>restorecon</command> command changes the type to <systemitem>httpd_sys_content_t</systemitem>:
</para>
-<screen># /sbin/restorecon -v /web
+<screen>~]# <command>restorecon -v /web</command>
restorecon reset /web context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
</screen>
<para>
- By default, newly-created files and directories inherit the SELinux type of their parent folders. When using this example, and before removing the SELinux context added for <filename>/web/</filename>, files and directories created in the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type.
- </para>
- </listitem>
- <listitem>
- <para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /web</command> command to remove the context added for <filename>/web/</filename>.
+ By default, newly-created files and directories inherit the SELinux type of their parent folders. When using this example, and before removing the SELinux context added for <filename>/web/</filename>, files and directories created in the <filename>/web/</filename> directory are labeled with the <systemitem>httpd_sys_content_t</systemitem> type.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to restore the default SELinux context.
+ As the Linux root user, run the <command>semanage fcontext -d /web</command> command to remove the context added for <filename>/web/</filename>.
</para>
- </listitem>
- </orderedlist>
- <formalpara id="form-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Changing_a_Directory_and_its_Contents_Types">
- <title>Changing a Directory and its Contents Types</title>
- <para>
- The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>mkdir /web</command> command to create a new directory, and then the <command>touch /web/file{1,2,3}</command> command to create 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). The <filename>/web/</filename> directory and files in it are labeled with the <computeroutput>default_t</computeroutput> type:
+ As the Linux root user, run the <command>restorecon -v /web</command> command to restore the default SELinux context.
</para>
-
-<screen># ls -dZ /web
+ </step>
+ </procedure>-->
+
+ <procedure id="proc-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Changing_a_Directory_and_its_Contents_Types">
+ <title>Changing a Directory and its Contents Types</title>
+ <para>
+ The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename class="directory">/var/www/html/</filename>):
+ </para>
+ <step>
+ <para>
+ As the root user, create a new <filename class="directory">/mkdir/</filename>directory and then 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>) within this directory. The <filename class="directory">/web/</filename> directory and files in it are labeled with the <systemitem>default_t</systemitem> type:
+ </para>
+<screen><prompt>~]#</prompt> <command>mkdir /web</command></screen>
+<screen><prompt>~]#</prompt> <command>touch /web/file{1,2,3}</command></screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -dZ /web</command>
drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web
-# ls -lZ /web
+</screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -lZ /web</command>
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command to change the type of the <filename>/web/</filename> directory and the files in it, to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</computeroutput> regular expression causes the <command>semanage</command> command to apply changes to the <filename>/web/</filename> directory, as well as the files in it. Note: running this command does not directly change the type - <filename>/web/</filename> and files in it are still labeled with the <computeroutput>default_t</computeroutput> type:
+ As root, run the following command to change the type of the <filename class="directory">/web/</filename> directory and the files in it, to <systemitem>httpd_sys_content_t</systemitem>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</computeroutput> regular expression causes <systemitem>semanage</systemitem> to apply changes to <filename class="directory">/web/</filename>, as well as the files in it. Note that running this command does not directly change the type; <filename class="directory">/web/</filename> and files in it are still labeled with the <systemitem>default_t</systemitem> type:
</para>
-
-<screen># ls -dZ /web
+<screen><prompt>~]#</prompt> <command>semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -dZ /web</command>
drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /web
-# ls -lZ /web
+</screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -lZ /web</command>
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:default_t:s0 file3
</screen>
<para>
- The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:
+ The <command>semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:
</para>
-
-<screen>/web(/.*)? system_u:object_r:httpd_sys_content_t:s0
+<screen>
+/web(/.*)? system_u:object_r:httpd_sys_content_t:s0
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to change the type of the <filename>/web/</filename> directory, as well as all files in it. The <option>-R</option> is for recursive, which means all files and directories under the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, the <command>/sbin/restorecon</command> command changes the types to <computeroutput>httpd_sys_content_t</computeroutput>:
+ As root, use the <systemitem>restorecon</systemitem> utility to change the type of <filename class="directory">/web/</filename>, as well as all files in it. The <option>-R</option> is for recursive, which means all files and directories under <filename class="directory">/web/</filename> are labeled with the <systemitem>httpd_sys_content_t</systemitem> type. Since <systemitem>semanage</systemitem> added an entry to <filename>file.contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, <systemitem>restorecon</systemitem> changes the types to <systemitem>httpd_sys_content_t</systemitem>:
</para>
-
-<screen># /sbin/restorecon -R -v /web
+<screen>
+<prompt>~]#</prompt> <command>restorecon -R -v /web</command>
restorecon reset /web context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /web/file2 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /web/file3 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
</screen>
+
+ <note>
+ <para>
+ By default, newly-created files and directories inherit the SELinux type of their parent directories. For example, when creating a new file in the <filename class="directory">/etc/</filename> directory that is labeled with the <systemitem>etc_t</systemitem> type, the new file inherits the same type:
+ </para>
+<screen>
+~]$ <command>ls -dZ - /etc/</command>
+drwxr-xr-x. root root system_u:object_r:<emphasis>etc_t</emphasis>:s0 /etc
+</screen>
+<screen>~]# <command>touch /etc/file1</command></screen>
+<screen>
+~]# <command>ls -lZ /etc/file1</command>
+-rw-r--r--. root root unconfined_u:object_r:<emphasis>etc_t</emphasis>:s0 /etc/file1
+</screen>
+ </note>
+ </step>
+ <!-- as per RT#122301
+ <step>
<para>
- By default, newly-created files and directories inherit the SELinux type of their parents. In this example, files and directories created in the <filename>/web/</filename> directory will be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type.
- </para>
- </listitem>
- <listitem>
- <para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command> command to remove the context added for <computeroutput>"/web(/.*)?"</computeroutput>.
+ As the Linux root user, run the <command>semanage fcontext -d "/web(/.*)?"</command> command to remove the context added for <computeroutput>"/web(/.*)?"</computeroutput>.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to restore the default SELinux contexts.
+ As the Linux root user, run the <command>restorecon -R -v /web</command> command to restore the default SELinux contexts.
</para>
- </listitem>
- </orderedlist>
- <formalpara id="form-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Deleting_an_added_Context">
- <title>Deleting an added Context</title>
- <para>
- The following example demonstrates adding and removing an SELinux context:
- </para>
- </formalpara>
- <orderedlist>
- <listitem>
- <para>
- As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /test</command> command. The <filename>/test/</filename> directory does not have to exist. This command adds the following context to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:
+ </step>-->
+ </procedure>
+
+ <procedure id="proc-Security-Enhanced_Linux-Persistent_Changes_semanage_fcontext-Deleting_an_added_Context">
+ <title>Deleting an added Context</title>
+ <para>
+ The following example demonstrates adding and removing an SELinux context. If the context is part of a regular expression, for example, <computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the regular expression:
+ </para>
+<screen><prompt>~]#</prompt> <command>semanage fcontext -d "/web(/.*)?"</command>
+ </screen>
+ <!-- as per RT#122301
+ <step>
+ <para>
+ As the Linux root user, run the <command>semanage fcontext -a -t httpd_sys_content_t /test</command> command. The <filename>/test/</filename> directory does not have to exist. This command adds the following context to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:
</para>
<screen>/test system_u:object_r:httpd_sys_content_t:s0
</screen>
- </listitem>
- <listitem>
+ </step>-->
+ <step>
<para>
- To remove the context, as the Linux root user, run the <command>/usr/sbin/semanage fcontext -d <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, where <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable> is the first part in <filename>file_contexts.local</filename>. The following is an example of a context in <filename>file_contexts.local</filename>:
+ To remove the context, as root, run the following command, where <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable> is the first part in <filename>file_contexts.local</filename>:
+ </para>
+<screen><prompt>~]#</prompt> <command>semanage fcontext -d <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command></screen>
+ <para>
+ The following is an example of a context in <filename>file_contexts.local</filename>:
</para>
-
-<screen>/test system_u:object_r:httpd_sys_content_t:s0
+<screen>
+/test system_u:object_r:httpd_sys_content_t:s0
</screen>
<para>
- With the first part being <computeroutput>/test</computeroutput>. To prevent the <filename>/test/</filename> directory from being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> after running <command>/sbin/restorecon</command>, or after a file system relabel, run the following command as the Linux root user to delete the context from <filename>file_contexts.local</filename>:
- </para>
- <para>
- <command>/usr/sbin/semanage fcontext -d /test</command>
+ With the first part being <computeroutput>/test</computeroutput>. To prevent the <filename class="directory">/test/</filename> directory from being labeled with the <systemitem>httpd_sys_content_t</systemitem> after running <command>restorecon</command>, or after a file system relabel, run the following command as root to delete the context from <filename>file_contexts.local</filename>:
</para>
- </listitem>
- </orderedlist>
+<screen><prompt>~]#</prompt> <command>semanage fcontext -d /test</command></screen>
+ </step>
+ <step>
+ <para>
+ As root, use the <systemitem>restorecon</systemitem> utility to restore the default SELinux context.
+ </para>
+ </step>
+ </procedure>
<para>
- If the context is part of a regular expression, for example, <computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the regular expression:
- </para>
- <para>
- <command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command>
- </para>
- <para>
- Refer to the <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information about <command>/usr/sbin/semanage</command>.
+ See the <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information about <command>semanage</command>.
</para>
<important>
<para>
- When changing the SELinux context with <command>/usr/sbin/semanage fcontext -a</command>, use the full path to the file or directory to avoid files being mislabeled after a file system relabel, or after the <command>/sbin/restorecon</command> command is run.
+ When changing the SELinux context with <command>semanage fcontext -a</command>, use the full path to the file or directory to avoid files being mislabeled after a file system relabel, or after the <command>restorecon</command> command is run.
</para>
</important>
</section>
@@ -983,15 +1157,15 @@ restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0->syste
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types">
<title>The file_t and default_t Types</title>
- <para>
- For file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. This should be the only use of this type, so that files without a context on disk can be distinguished in policy, and generally kept inaccessible to confined domains. The <computeroutput>file_t</computeroutput> type should not exist on correctly-labeled file systems, because all files on a system running SELinux should have an SELinux context, and the <computeroutput>file_t</computeroutput> type is never used in file-context configuration<footnote>
+ <para>
+ When using a file system that supports extended attributes (EA), the <systemitem>file_t</systemitem> type is the default type of a file that has not yet been assigned <acronym>EA</acronym> value. This type is only used for this purpose and does not exist on correctly-labeled file systems, because all files on a system running SELinux should have a proper SELinux context, and the <systemitem>file_t</systemitem> type is never used in file-context configuration<footnote>
<para>
- Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directories to their default contexts.
+ Files in the <filename class="directory">/etc/selinux/targeted/contexts/files/</filename> directory define contexts for files and directories. Files in this directory are read by the <systemitem>restorecon</systemitem> and <systemitem>setfiles</systemitem> utilities to restore files and directories to their default contexts.
</para>
</footnote>.
</para>
<para>
- The <computeroutput>default_t</computeroutput> type is used on files that do not match any other pattern in file-context configuration, so that such files can be distinguished from files that do not have a context on disk, and generally kept inaccessible to confined domains. If you create a new top-level directory, such as <filename>/mydirectory/</filename>, this directory may be labeled with the <computeroutput>default_t</computeroutput> type. If services need access to such a directory, update the file-contexts configuration for this location. Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for details on adding a context to the file-context configuration.
+ The <systemitem>default_t</systemitem> type is used on files that do not match any pattern in file-context configuration, so that such files can be distinguished from files that do not have a context on disk, and generally are kept inaccessible to confined domains. For example, if you create a new top-level directory, such as <filename class="directory">/mydirectory/</filename>, this directory may be labeled with the default_t type. If services need access to this directory, you need to update the file-contexts configuration for this location. See <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for details on adding a context to the file-context configuration.
</para>
</section>
@@ -1001,7 +1175,7 @@ restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0->syste
By default, when a file system that supports extended attributes is mounted, the security context for each file is obtained from the <emphasis>security.selinux</emphasis> extended attribute of the file. Files in file systems that do not support extended attributes are assigned a single, default security context from the policy configuration, based on file system type.
</para>
<para>
- Use the <command>mount -o context</command> command to override existing extended attributes, or to specify a different, default context for file systems that do not support extended attributes. This is useful if you do not trust a file system to supply the correct attributes, for example, removable media used in multiple systems. The <command>mount -o context</command> command can also be used to support labeling for file systems that do not support extended attributes, such as File Allocation Table (FAT) or NFS file systems. The context specified with the <option>context</option> is not written to disk: the original contexts are preserved, and are seen when mounting without a <option>context</option> option (if the file system had extended attributes in the first place).
+ Use the <command>mount -o context</command> command to override existing extended attributes, or to specify a different, default context for file systems that do not support extended attributes. This is useful if you do not trust a file system to supply the correct attributes, for example, removable media used in multiple systems. The <command>mount -o context</command> command can also be used to support labeling for file systems that do not support extended attributes, such as File Allocation Table (FAT) or NFS volumes. The context specified with the <option>context</option> option is not written to disk: the original contexts are preserved, and are seen when mounting without <option>context</option> (if the file system had extended attributes in the first place).
</para>
<para>
For further information about file system labeling, refer to James Morris's "Filesystem Labeling in SELinux" article: <ulink url="http://www.linuxjournal.com/article/7426"></ulink>.
@@ -1009,23 +1183,19 @@ restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0->syste
<section id="sect-Security-Enhanced_Linux-Mounting_File_Systems-Context_Mounts">
<title>Context Mounts</title>
<para>
- To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the Linux root user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:level</replaceable></command> command when mounting the desired file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Without additional mount options, this may prevent sharing NFS file systems via other services, such as the Apache HTTP Server. The following example mounts an NFS file system so that it can be shared via the Apache HTTP Server:
+ To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the root user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:level</replaceable></command> command when mounting the desired file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the <systemitem>nfs_t</systemitem> type. Without additional mount options, this may prevent sharing NFS volumes using other services, such as the Apache HTTP Server. The following example mounts an NFS volume so that it can be shared via the Apache HTTP Server:
</para>
-
-
-<screen># mount server:/export /local/mount/point -o\
-context="system_u:object_r:httpd_sys_content_t:s0"
-</screen>
-
+<screen><prompt>~]#</prompt> <command>mount server:/export /local/mount/point -o \
+context="system_u:object_r:httpd_sys_content_t:s0"</command></screen>
<para>
- Newly-created files and directories on this file system appear to have the SELinux context specified with <option>-o context</option>; however, since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified.
+ Newly-created files and directories on this file system appear to have the SELinux context specified with <option>-o context</option>. However, since these changes are not written to disk, the context specified with this option does not persist between mounts. Therefore, this option must be used with the same context specified during every mount to retain the desired context. For information about making context mount persistent, refer to <xref linkend="sect-Security-Enhanced_Linux-Mounting_File_Systems-Making_Context_Mounts_Persistent" />.
</para>
<para>
- Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with <option>-o context</option>, use the SELinux <computeroutput>system_u</computeroutput> user and <computeroutput>object_r</computeroutput> role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the <computeroutput>s0</computeroutput> level.
+ Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with <option>-o context</option>, use the SELinux <systemitem>system_u</systemitem> user and <systemitem>object_r</systemitem> role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the <systemitem>s0</systemitem> level.
</para>
<note>
<para>
- When a file system is mounted with a <option>context</option> option, context changes (by users and processes) are prohibited. For example, running <command>chcon</command> on a file system mounted with a <option>context</option> option results in a <computeroutput>Operation not supported</computeroutput> error.
+ When a file system is mounted with a <option>context</option> option, context changes (by users and processes) are prohibited. For example, running the <command>chcon</command> command on a file system mounted with a <option>context</option> option results in a <computeroutput>Operation not supported</computeroutput> error.
</para>
</note>
</section>
@@ -1033,14 +1203,12 @@ context="system_u:object_r:httpd_sys_content_t:s0"
<section id="sect-Security-Enhanced_Linux-Mounting_File_Systems-Changing_the_Default_Context">
<title>Changing the Default Context</title>
<para>
- As mentioned in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. If it is desirable to use a different default context, mount the file system with the <option>defcontext</option> option.
+ As mentioned in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <systemitem>file_t</systemitem> type. If it is desirable to use a different default context, mount the file system with the <option>defcontext</option> option.
</para>
<para>
- The following example mounts a newly-created file system (on <filename>/dev/sda2</filename>) to the newly-created <filename>/test/</filename> directory. It assumes that there are no rules in <filename>/etc/selinux/targeted/contexts/files/</filename> that define a context for the <filename>/test/</filename> directory:
+ The following example mounts a newly-created file system (on <filename>/dev/sda2</filename>) to the newly-created <filename class="directory">/test/</filename> directory. It assumes that there are no rules in <filename class="directory">/etc/selinux/targeted/contexts/files/</filename> that define a context for the <filename>/test/</filename> directory:
</para>
-
-<screen>
-# mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:s0"
+<screen><prompt>~]#</prompt> <command>mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:s0"</command>
</screen>
<para>
In this example:
@@ -1057,50 +1225,43 @@ context="system_u:object_r:httpd_sys_content_t:s0"
</listitem>
<listitem>
<para>
- when mounted, the root directory (<filename>/test/</filename>) of the file system is treated as if it is labeled with the context specified by <option>defcontext</option> (this label is not stored on disk). This affects the labeling for files created under <filename>/test/</filename>: new files inherit the <computeroutput>samba_share_t</computeroutput> type, and these labels are stored on disk.
+ when mounted, the root directory (<filename class="directory">/test/</filename>) of the file system is treated as if it is labeled with the context specified by <option>defcontext</option> (this label is not stored on disk). This affects the labeling for files created under <filename class="directory">/test/</filename>: new files inherit the <systemitem>samba_share_t</systemitem> type, and these labels are stored on disk.
</para>
</listitem>
<listitem>
<para>
- files created under <filename>/test/</filename> while the file system was mounted with a <option>defcontext</option> option retain their labels.
+ files created under <filename class="directory">/test/</filename> while the file system was mounted with a <option>defcontext</option> option retain their labels.
</para>
</listitem>
</itemizedlist>
</section>
<section id="sect-Security-Enhanced_Linux-Mounting_File_Systems-Mounting_an_NFS_File_System">
- <title>Mounting an NFS File System</title>
+ <title>Mounting an NFS Volume</title>
<para>
- By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Depending on policy configuration, services, such as Apache HTTP Server and MySQL, may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services.
+ By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the <systemitem>nfs_t</systemitem> type. Depending on policy configuration, services, such as Apache HTTP Server and MariaDB, may not be able to read files labeled with the <systemitem>nfs_t</systemitem> type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services.
</para>
<para>
- If you would like to mount an NFS file system and read or export that file system with another service, use the <option>context</option> option when mounting to override the <computeroutput>nfs_t</computeroutput> type. Use the following context option to mount NFS file systems so that they can be shared via the Apache HTTP Server:
+ If you would like to mount an NFS volume and read or export that file system with another service, use the <option>context</option> option when mounting to override the <systemitem>nfs_t</systemitem> type. Use the following context option to mount NFS volumes so that they can be shared via the Apache HTTP Server:
</para>
-<screen>mount server:/export /local/mount/point -o\
-context="system_u:object_r:httpd_sys_content_t:s0"
-</screen>
+<screen><prompt>~]#</prompt> <command>mount server:/export /local/mount/point -o context="system_u:object_r:httpd_sys_content_t:s0"</command></screen>
<para>
- Since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified.
+ Since these changes are not written to disk, the context specified with this option does not persist between mounts. Therefore, this option must be used with the same context specified during every mount to retain the desired context. For information about making context mount persistent, refer to <xref linkend="sect-Security-Enhanced_Linux-Mounting_File_Systems-Making_Context_Mounts_Persistent" />.
</para>
<para>
- As an alternative to mounting file systems with <option>context</option> options, Booleans can be turned on to allow services access to file systems labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /> for instructions on configuring Booleans to allow services access to the <computeroutput>nfs_t</computeroutput> type.
+ As an alternative to mounting file systems with <option>context</option> options, Booleans can be enabled to allow services access to file systems labeled with the <systemitem>nfs_t</systemitem> type. <!--Refer to <xref linkend="Managing_Confined_Services.xml" /> --> for instructions on configuring Booleans to allow services access to the <systemitem>nfs_t</systemitem> type.
</para>
</section>
<section id="sect-Security-Enhanced_Linux-Mounting_File_Systems-Multiple_NFS_Mounts">
<title>Multiple NFS Mounts</title>
<para>
- When mounting multiple mounts from the same NFS export, attempting to override the SELinux context of each mount with a different context, results in subsequent mount commands failing. In the following example, the NFS server has a single export, <filename>/export</filename>, which has two subdirectories, <filename>web/</filename> and <filename>database/</filename>. The following commands attempt two mounts from a single NFS export, and try to override the context for each one:
+ When mounting multiple mounts from the same NFS export, attempting to override the SELinux context of each mount with a different context, results in subsequent mount commands failing. In the following example, the NFS server has a single export, <filename class="directory">/export/</filename>, which has two subdirectories, <filename class="directory">/web/</filename> and <filename class="directory">/database/</filename>. The following commands attempt two mounts from a single NFS export, and try to override the context for each one:
</para>
-
-<screen>
-# mount server:/export/web /local/web -o\
-context="system_u:object_r:httpd_sys_content_t:s0"
+<screen><prompt>~]#</prompt> <command>mount server:/export/web /local/web -o context="system_u:object_r:httpd_sys_content_t:s0"</command></screen>
-# mount server:/export/database /local/database -o\
-context="system_u:object_r:mysqld_db_t:s0"
-</screen>
+<screen><prompt>~]#</prompt> <command>mount server:/export/database /local/database -o context="system_u:object_r:mysqld_db_t:s0"</command></screen>
<para>
The second mount command fails, and the following is logged to <filename>/var/log/messages</filename>:
</para>
@@ -1111,20 +1272,16 @@ kernel: SELinux: mount invalid. Same superblock, different security settings fo
<para>
To mount multiple mounts from a single NFS export, with each mount having a different context, use the <option>-o nosharecache,context</option> options. The following example mounts multiple mounts from a single NFS export, with a different context for each mount (allowing a single service access to each one):
</para>
-
-<screen>
-# mount server:/export/web /local/web -o\
-nosharecache,context="system_u:object_r:httpd_sys_content_t:s0"
-
-# mount server:/export/database /local/database -o\
-nosharecache,context="system_u:object_r:mysqld_db_t:s0"
-</screen>
+
+<screen><prompt>~]#</prompt> <command>mount server:/export/web /local/web -o nosharecache,context="system_u:object_r:httpd_sys_content_t:s0"</command></screen>
+<screen><prompt>~]#</prompt> <command>mount server:/export/database /local/database -o \
+nosharecache,context="system_u:object_r:mysqld_db_t:s0"</command></screen>
<para>
- In this example, <computeroutput>server:/export/web</computeroutput> is mounted locally to <filename>/local/web/</filename>, with all files being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, allowing Apache HTTP Server access. <computeroutput>server:/export/database</computeroutput> is mounted locally to <filename>/local/database</filename>, with all files being labeled with the <computeroutput>mysqld_db_t</computeroutput> type, allowing MySQL access. These type changes are not written to disk.
+ In this example, <computeroutput>server:/export/web</computeroutput> is mounted locally to the <filename class="directory">/local/web/</filename> directory, with all files being labeled with the <systemitem>httpd_sys_content_t</systemitem> type, allowing Apache HTTP Server access. <computeroutput>server:/export/database</computeroutput> is mounted locally to <filename class="directory">/local/database/</filename>, with all files being labeled with the <systemitem>mysqld_db_t</systemitem> type, allowing MariaDB access. These type changes are not written to disk.
</para>
<important>
<para>
- The <option>nosharecache</option> options allows you to mount the same subdirectory of an export multiple times with different contexts (for example, mounting <filename>/export/web</filename> multiple times). Do not mount the same subdirectory from an export multiple times with different contexts, as this creates an overlapping mount, where files are accessible under two different contexts.
+ The <option>nosharecache</option> options allows you to mount the same subdirectory of an export multiple times with different contexts (for example, mounting <filename class="directory">/export/web/</filename> multiple times). Do not mount the same subdirectory from an export multiple times with different contexts, as this creates an overlapping mount, where files are accessible under two different contexts.
</para>
</important>
</section>
@@ -1132,131 +1289,197 @@ nosharecache,context="system_u:object_r:mysqld_db_t:s0"
<section id="sect-Security-Enhanced_Linux-Mounting_File_Systems-Making_Context_Mounts_Persistent">
<title>Making Context Mounts Persistent</title>
<para>
- To make context mounts persistent across remounting and reboots, add entries for the file systems in <filename>/etc/fstab</filename> or an automounter map, and use the desired context as a mount option. The following example adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:
+ To make context mounts persistent across remounting and reboots, add entries for the file systems in the <filename>/etc/fstab</filename> file or an automounter map, and use the desired context as a mount option. The following example adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:
</para>
<screen>
server:/export /local/mount/ nfs context="system_u:object_r:httpd_sys_content_t:s0" 0 0
</screen>
- <para>
- Refer to the <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploy...">Red Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client Configuration"</ulink> for information about mounting NFS file systems.
- </para>
</section>
</section>
<section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Maintaining_SELinux_Labels_">
- <title>Maintaining SELinux Labels </title>
+ <title>Maintaining SELinux Labels</title>
<para>
These sections describe what happens to SELinux contexts when copying, moving, and archiving files and directories. Also, it explains how to preserve contexts when copying and archiving.
</para>
<section id="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Copying_Files_and_Directories">
<title>Copying Files and Directories</title>
<para>
- When a file or directory is copied, a new file or directory is created if it does not exist. That new file or directory's context is based on default-labeling rules, not the original file or directory's context (unless options were used to preserve the original context). For example, files created in user home directories are labeled with the <computeroutput>user_home_t</computeroutput> type:
+ When a file or directory is copied, a new file or directory is created if it does not exist. That new file or directory's context is based on default-labeling rules, not the original file or directory's context (unless options were used to preserve the original context). For example, files created in user home directories are labeled with the <systemitem>user_home_t</systemitem> type:
</para>
+<screen><prompt>~]$</prompt> <command>touch file1</command></screen>
<screen>
-$ touch file1
-$ ls -Z file1
+<prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
</screen>
<para>
- If such a file is copied to another directory, such as <filename>/etc/</filename>, the new file is created in accordance to default-labeling rules for the <filename>/etc/</filename> directory. Copying a file (without additional options) may not preserve the original context:
+ If such a file is copied to another directory, such as <filename class="directory">/etc/</filename>, the new file is created in accordance to default-labeling rules for <filename class="directory">/etc/</filename>. Copying a file (without additional options) may not preserve the original context:
</para>
<screen>
-$ ls -Z file1
+<prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
-# cp file1 /etc/
-$ ls -Z /etc/file1
+</screen>
+<screen><prompt>~]#</prompt> <command>cp file1 /etc/</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /etc/file1</command>
-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1
</screen>
<para>
- When <filename>file1</filename> is copied to <filename>/etc/</filename>, if <filename>/etc/file1</filename> does not exist, <filename>/etc/file1</filename> is created as a new file. As shown in the example above, <filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</computeroutput> type, in accordance to default-labeling rules.
+ When <filename>file1</filename> is copied to <filename class="directory">/etc/</filename>, if <filename>/etc/file1</filename> does not exist, <filename>/etc/file1</filename> is created as a new file. As shown in the example above, <filename>/etc/file1</filename> is labeled with the <systemitem>etc_t</systemitem> type, in accordance to default-labeling rules.
</para>
<para>
When a file is copied over an existing file, the existing file's context is preserved, unless the user specified <command>cp</command> options to preserve the context of the original file, such as <option>--preserve=context</option>. SELinux policy may prevent contexts from being preserved during copies.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Copying_Files_and_Directories-Copying_Without_Preserving_SELinux_Contexts">
- <title>Copying Without Preserving SELinux Contexts</title>
- <para>
- When copying a file with the <command>cp</command> command, if no options are given, the type is inherited from the targeted, parent directory:
- </para>
- </formalpara>
-
+ </para>
+ <procedure id="proc-Security-Enhanced_Linux-Copying_Files_and_Directories-Copying_Without_Preserving_SELinux_Contexts">
+ <title>Copying Without Preserving SELinux Contexts</title>
+ <para>
+ This procedure shows that when copying a file with the <command>cp</command> command, if no options are given, the type is inherited from the targeted, parent directory.
+ </para>
+ <step>
+ <para>
+ Create a file in a user's home directory. The file is labeled with the <systemitem>user_home_t</systemitem> type:
+ </para>
+<screen><prompt>~]$</prompt> <command>touch file1</command></screen>
<screen>
-$ touch file1
-$ ls -Z file1
+<prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
-$ ls -dZ /var/www/html/
+</screen>
+ </step>
+ <step>
+ <para>
+ The <filename class="directory">/var/www/html/</filename> directory is labeled with the <systemitem>httpd_sys_content_t</systemitem> type, as shown with the following command:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>ls -dZ /var/www/html/</command>
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/
-# cp file1 /var/www/html/
-$ ls -Z /var/www/html/file1
+</screen>
+ </step>
+ <step>
+ <para>
+ When <filename>file1</filename> is copied to <filename class="directory">/var/www/html/</filename>, it inherits the <systemitem>httpd_sys_content_t</systemitem> type:
+ </para>
+<screen><prompt>~]#</prompt> <command>cp file1 /var/www/html/</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /var/www/html/file1</command>
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/file1
</screen>
- <para>
- In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. When <filename>file1</filename> is copied to <filename>/var/www/html/</filename>, it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -Z /var/www/html/file1</command> command.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Copying_Files_and_Directories-Preserving_SELinux_Contexts_When_Copying">
- <title>Preserving SELinux Contexts When Copying</title>
- <para>
- Use the <command>cp --preserve=context</command> command to preserve contexts when copying:
- </para>
- </formalpara>
-
+ </step>
+
+ </procedure>
+ <procedure id="proc-Security-Enhanced_Linux-Copying_Files_and_Directories-Preserving_SELinux_Contexts_When_Copying">
+ <title>Preserving SELinux Contexts When Copying</title>
+ <para>
+ This procedure shows how to use the <option>--preserve=context</option> option to preserve contexts when copying.
+ </para>
+ <step>
+ <para>
+ Create a file in a user's home directory. The file is labeled with the <systemitem>user_home_t</systemitem> type:
+ </para>
+<screen><prompt>~]$</prompt> <command>touch file1</command></screen>
<screen>
-$ touch file1
-$ ls -Z file1
+<prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
-$ ls -dZ /var/www/html/
+</screen>
+ </step>
+ <step>
+ <para>
+ The <filename class="directory">/var/www/html/</filename> directory is labeled with the <systemitem>httpd_sys_content_t</systemitem> type, as shown with the following command:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>ls -dZ /var/www/html/</command>
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/
-# cp --preserve=context file1 /var/www/html/
-$ ls -Z /var/www/html/file1
--rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/file1
</screen>
- <para>
- In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. Using the <option>--preserve=context</option> option preserves SELinux contexts during copy operations. As shown with the <command>ls -Z /var/www/html/file1</command> command, the <filename>file1</filename> <computeroutput>user_home_t</computeroutput> type was preserved when the file was copied to <filename>/var/www/html/</filename>.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Copying_Files_and_Directories-Copying_and_Changing_the_Context">
- <title>Copying and Changing the Context</title>
+ </step>
+ <step>
+ <para>
+ Using the <option>--preserve=context</option> option preserves SELinux contexts during copy operations. As shown below, the <systemitem>user_home_t</systemitem> type of <filename>file1</filename> was preserved when the file was copied to <filename class="directory">/var/www/html/</filename>:
+ </para>
+<screen><prompt>~]#</prompt> <command>cp --preserve=context file1 /var/www/html/</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /var/www/html/file1</command>
+-rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/file1
+</screen>
+ </step>
+ </procedure>
+ <procedure id="proc-Security-Enhanced_Linux-Copying_Files_and_Directories-Copying_and_Changing_the_Context">
+ <title>Copying and Changing the Context</title>
<para>
- Use the <command>cp -Z</command> command to change the destination copy's context. The following example was performed in the user's home directory:
- </para>
- </formalpara>
-
+ This procedure show how to use the <option>--context</option> option to change the destination copy's context. The following example is performed in the user's home directory:
+ </para>
+ <step>
+ <para>
+ Create a file in a user's home directory. The file is labeled with the <systemitem>user_home_t</systemitem> type:
+ </para>
+<screen><prompt>~]$</prompt> <command>touch file1</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z file1</command>
+-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
+</screen>
+ </step>
+ <step>
+ <para>
+ Use the <option>--context</option> option to define the SELinux context:
+ </para>
+<screen><prompt>~]$</prompt> <command>cp --context=system_u:object_r:samba_share_t:s0 file1 file2</command></screen>
+ </step>
+ <step>
+ <para>
+ Without <option>--context</option>, <filename>file2</filename> would be labeled with the <computeroutput>unconfined_u:object_r:user_home_t</computeroutput> context:
+ </para>
<screen>
-$ touch file1
-$ cp -Z system_u:object_r:samba_share_t:s0 file1 file2
-$ ls -Z file1 file2
+<prompt>~]$</prompt> <command>ls -Z file1 file2</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
-rw-rw-r-- user1 group1 system_u:object_r:samba_share_t:s0 file2
-$ rm file1 file2
</screen>
- <para>
- In this example, the context is defined with the <option>-Z</option> option. Without the <option>-Z</option> option, <filename>file2</filename> would be labeled with the <computeroutput>unconfined_u:object_r:user_home_t</computeroutput> context.
- </para>
- <formalpara id="form-Security-Enhanced_Linux-Copying_Files_and_Directories-Copying_a_File_Over_an_Existing_File">
- <title>Copying a File Over an Existing File</title>
- <para>
- When a file is copied over an existing file, the existing file's context is preserved (unless an option is used to preserve contexts). For example:
- </para>
- </formalpara>
-
+ </step>
+
+ </procedure>
+ <procedure id="proc-Security-Enhanced_Linux-Copying_Files_and_Directories-Copying_a_File_Over_an_Existing_File">
+ <title>Copying a File Over an Existing File</title>
+ <para>
+ This procedure shows that when a file is copied over an existing file, the existing file's context is preserved (unless an option is used to preserve contexts).
+ </para>
+ <step>
+ <para>
+ As root, create a new file, <filename>file1</filename> in the <filename class="directory">/etc/</filename> directory. As shown below, the file is labeled with the <systemitem>etc_t</systemitem> type:
+ </para>
+<screen><prompt>~]#</prompt> <command>touch /etc/file1</command></screen>
<screen>
-# touch /etc/file1
-# ls -Z /etc/file1
+<prompt>~]$</prompt> <command>ls -Z /etc/file1</command>
-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1
-# touch /tmp/file2
-# ls -Z /tmp/file2
+</screen>
+ </step>
+ <step>
+ <para>
+ Create another file, <filename>file2</filename>, in the <filename class="directory">/tmp/</filename> directory. As shown below, the file is labeled with the <systemitem>user_tmp_t</systemitem> type:
+ </para>
+<screen><prompt>~]$</prompt> <command>touch /tmp/file2</command></screen>
+<screen>
+<prompt>~$</prompt> <command>ls -Z /tmp/file2</command>
-rw-r--r-- root root unconfined_u:object_r:user_tmp_t:s0 /tmp/file2
-# cp /tmp/file2 /etc/file1
-# ls -Z /etc/file1
+</screen>
+ </step>
+ <step>
+ <para>
+ Overwrite <filename>file1</filename> with <filename>file2</filename>:
+ </para>
+<screen><prompt>~]#</prompt> <command>cp /tmp/file2 /etc/file1</command></screen>
+ </step>
+ <step>
+ <para>
+ After copying, the following command shows <filename>file1</filename> labeled with the <systemitem>etc_t</systemitem> type, not the <systemitem>user_tmp_t</systemitem> type from <filename>/tmp/file2</filename> that replaced <filename>/etc/file1</filename>:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /etc/file1</command>
-rw-r--r-- root root unconfined_u:object_r:etc_t:s0 /etc/file1
</screen>
- <para>
- In this example, two files are created: <filename>/etc/file1</filename>, labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> command overwrites <filename>file1</filename> with <filename>file2</filename>. After copying, the <command>ls -Z /etc/file1</command> command shows <filename>file1</filename> labeled with the <computeroutput>etc_t</computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> type from <filename>/tmp/file2</filename> that replaced <filename>/etc/file1</filename>.
- </para>
+ </step>
+
+ </procedure>
<important>
<para>
Copy files and directories, rather than moving them. This helps ensure they are labeled with the correct SELinux contexts. Incorrect SELinux contexts can prevent processes from accessing such files and directories.
@@ -1267,47 +1490,49 @@ $ rm file1 file2
<section id="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Moving_Files_and_Directories">
<title>Moving Files and Directories</title>
<para>
- File and directories keep their current SELinux context when they are moved. In many cases, this is incorrect for the location they are being moved to. The following example demonstrates moving a file from a user's home directory to <filename>/var/www/html/</filename>, which is used by the Apache HTTP Server. Since the file is moved, it does not inherit the correct SELinux context:
+ Files and directories keep their current SELinux context when they are moved. In many cases, this is incorrect for the location they are being moved to. The following example demonstrates moving a file from a user's home directory to the <filename class="directory">/var/www/html/</filename> directory, which is used by the Apache HTTP Server. Since the file is moved, it does not inherit the correct SELinux context:
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-Security-Enhanced_Linux-Copying_Files_and_Directories-Moving_Files_and_Directories">
+ <title>Moving Files and Directories</title>
+ <step>
<para>
- Run the <command>cd</command> command without any arguments to change into your home directory. Once in your home directory, run the <command>touch file1</command> command to create a file. This file is labeled with the <computeroutput>user_home_t</computeroutput> type:
+ Change into your home directory and create file in it. The file is labeled with the <systemitem>user_home_t</systemitem> type:
</para>
-
-<screen>$ ls -Z file1
+<screen><prompt>~]$</prompt> <command>touch file1</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux context of the <filename>/var/www/html/</filename> directory:
+ Run the following command to view the SELinux context of the <filename class="directory">/var/www/html/</filename> directory:
</para>
-
-<screen>$ ls -dZ /var/www/html/
+<screen>
+<prompt>~]$</prompt> <command>ls -dZ /var/www/html/</command>
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/
</screen>
<para>
- By default, the <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files and directories created under the <filename>/var/www/html/</filename> directory inherit this type, and as such, they are labeled with this type.
+ By default, <filename class="directory">/var/www/html/</filename> is labeled with the <systemitem>httpd_sys_content_t</systemitem> type. Files and directories created under <filename class="directory">/var/www/html/</filename> inherit this type, and as such, they are labeled with this type.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>mv file1 /var/www/html/</command> command to move <filename>file1</filename> to the <filename>/var/www/html/</filename> directory. Since this file is moved, it keeps its current <computeroutput>user_home_t</computeroutput> type:
+ As root, move <filename>file1</filename> to <filename>/var/www/html/</filename>. Since this file is moved, it keeps its current <systemitem>user_home_t</systemitem> type:
</para>
-
-<screen># mv file1 /var/www/html/
-# ls -Z /var/www/html/file1
+<screen><prompt>~]#</prompt> <command>mv file1 /var/www/html/</command></screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -Z /var/www/html/file1</command>
-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 /var/www/html/file1
</screen>
- </listitem>
- </orderedlist>
+ </step>
+ </procedure>
<para>
- By default, the Apache HTTP Server can not read files that are labeled with the <computeroutput>user_home_t</computeroutput> type. If all files comprising a web page are labeled with the <computeroutput>user_home_t</computeroutput> type, or another type that the Apache HTTP Server can not read, permission is denied when attempting to access them via Firefox or text-based Web browsers.
- </para>
+ By default, the Apache HTTP Server cannot read files that are labeled with the <systemitem>user_home_t</systemitem> type. If all files comprising a web page are labeled with the <systemitem>user_home_t</systemitem> type, or another type that the Apache HTTP Server cannot read, permission is denied when attempting to access them via web browsers, such as <application>Mozilla Firefox</application>.
+ </para>
<important>
<para>
- Moving files and directories with the <command>mv</command> command may result in the wrong SELinux context, preventing processes, such as the Apache HTTP Server and Samba, from accessing such files and directories.
+ Moving files and directories with the <command>mv</command> command may result in the incorrect SELinux context, preventing processes, such as the Apache HTTP Server and Samba, from accessing such files and directories.
</para>
</important>
</section>
@@ -1315,210 +1540,748 @@ drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/
<section id="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context">
<title>Checking the Default SELinux Context</title>
<para>
- Use the <command>/usr/sbin/matchpathcon</command> command to check if files and directories have the correct SELinux context. From the <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page: "<command>matchpathcon</command> queries the system policy and outputs the default security context associated with the file path."<footnote>
- <para>
- The <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>libselinux-utils</package> package in &PRODUCT;, is written by Daniel Walsh. Any edits or changes in this version were done by Murray McAllister.
- </para>
- </footnote>. The following example demonstrates using the <command>/usr/sbin/matchpathcon</command> command to verify that files in <filename>/var/www/html/</filename> directory are labeled correctly:
+ Use the <systemitem>matchpathcon</systemitem> utility to check if files and directories have the correct SELinux context. This utility queries the system policy and then provides the default security context associated with the file path.<footnote><para>Refer to the <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information about <systemitem>matchpathcon</systemitem>.</para></footnote> The following example demonstrates using <command>matchpathcon</command> to verify that files in <filename class="directory">/var/www/html/</filename> directory are labeled correctly:
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-Security-Enhanced_Linux-Copying_Files_and_Directories-Checking_the_Default_SELinux_Context">
+ <title>Checking the Default SELinux Conxtext with <systemitem>matchpathcon</systemitem></title>
+ <step>
<para>
- As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</command> command to create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). These files inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from the <filename>/var/www/html/</filename> directory:
+ As the root user, create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>) in the <filename class="directory">/var/www/html/</filename> directory. These files inherit the <systemitem>httpd_sys_content_t</systemitem> type from <filename>/var/www/html/</filename>:
</para>
-
-<screen># touch /var/www/html/file{1,2,3}
-# ls -Z /var/www/html/
+<screen><prompt>~]#</prompt> <command>touch /var/www/html/file{1,2,3}</command></screen>
+<screen>
+<prompt>~]#</prompt> <command>ls -Z /var/www/html/</command>
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>chcon -t samba_share_t /var/www/html/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP Server can not read files or directories labeled with the <computeroutput>samba_share_t</computeroutput> type.
+ As root, change the <filename>file1</filename> type to <systemitem>samba_share_t</systemitem>. Note that the Apache HTTP Server cannot read files or directories labeled with the <systemitem>samba_share_t</systemitem> type.
</para>
- </listitem>
- <listitem>
+<screen><prompt>~]#</prompt> <command>chcon -t samba_share_t /var/www/html/file1</command></screen>
+ </step>
+ <step>
<para>
- The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option compares the current SELinux context to the correct, default context in SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</command> command to check all files in the <filename>/var/www/html/</filename> directory:
+ The <systemitem>matchpathcon</systemitem> <option>-V</option> option compares the current SELinux context to the correct, default context in SELinux policy. Run the following command to check all files in the <filename class="directory">/var/www/html/</filename> directory:
</para>
-
-<screen>$ /usr/sbin/matchpathcon -V /var/www/html/*
+<screen>
+<prompt>~]$</prompt> <command>matchpathcon -V /var/www/html/*</command>
/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0
/var/www/html/file2 verified.
/var/www/html/file3 verified.
</screen>
- </listitem>
- </orderedlist>
+ </step>
+ </procedure>
<para>
- The following output from the <command>/usr/sbin/matchpathcon</command> command explains that <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type, but should be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type:
+ The following output from the <command>matchpathcon</command> command explains that <filename>file1</filename> is labeled with the <systemitem>samba_share_t</systemitem> type, but should be labeled with the <systemitem>httpd_sys_content_t</systemitem> type:
</para>
-<screen>/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0
-</screen>
+<screen>/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0</screen>
<para>
- To resolve the label problem and allow the Apache HTTP Server access to <filename>file1</filename>, as the Linux root user, run the <command>/sbin/restorecon -v /var/www/html/file1</command> command:
+ To resolve the label problem and allow the Apache HTTP Server access to <filename>file1</filename>, as root, use the <systemitem>restorecon</systemitem> utility:
</para>
-<screen># /sbin/restorecon -v /var/www/html/file1
+<screen>
+<prompt>~]#</prompt> <command>restorecon -v /var/www/html/file1</command>
restorecon reset /var/www/html/file1 context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0
</screen>
+<para>
+ </para>
</section>
<section id="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Archiving_Files_with_tar">
- <title>Archiving Files with tar</title>
+ <title>Archiving Files with <systemitem>tar</systemitem></title>
<para>
- <command>tar</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>tar --selinux</command> to create archives that retain contexts. If a Tar archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, run the archive through <command>/sbin/restorecon</command>:
+ The <systemitem>tar</systemitem> utility does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use the <command>tar --selinux</command> command to create archives that retain contexts. If a <systemitem>tar</systemitem> archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, use the <systemitem>restorecon</systemitem> utility:
</para>
-
<screen>
-$ tar -xvf <replaceable>archive.tar</replaceable> | /sbin/restorecon -f -
+<prompt>~]$</prompt> <command>tar -xvf <replaceable>archive.tar</replaceable> | restorecon -f -</command>
</screen>
<para>
- Note: depending on the directory, you may need to be the Linux root user to run the <command>/sbin/restorecon</command> command.
+ Note that depending on the directory, you may need to be the root user to run the <systemitem>restorecon</systemitem>.
</para>
<para>
- The following example demonstrates creating a Tar archive that retains SELinux contexts:
+ The following example demonstrates creating a <systemitem>tar</systemitem> archive that retains SELinux contexts:
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-Security-Enhanced_Linux-Archiving_Files_with_tar-Creating_a_tar_Archive">
+ <title>Creating a tar Archive</title>
+ <step>
<para>
- As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</command> command to create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). These files inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from the <filename>/var/www/html/</filename> directory:
+ As root, create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>) in the <filename class="directory">/var/www/html/</filename> directory. These files inherit the <systemitem>httpd_sys_content_t</systemitem> type from <filename>/var/www/html/</filename>:
</para>
-
+<screen><prompt>~]#</prompt> <command>touch /var/www/html/file{1,2,3}</command></screen>
<screen>
-# touch /var/www/html/file{1,2,3}
-# ls -Z /var/www/html/
+<prompt>~]#</prompt> <command>ls -Z /var/www/html/</command>
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3
</screen>
- </listitem>
- <listitem>
- <para>
- Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}</command> command to create a Tar archive named <filename>test.tar</filename>.
- </para>
- </listitem>
- <listitem>
- <para>
- As the Linux root user, run the <command>mkdir /test</command> command to create a new directory, and then, run the <command>chmod 777 /test/</command> command to allow all users full-access to the <filename>/test/</filename> directory.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>cp /var/www/html/test.tar /test/</command> command to copy the <filename>test.tar</filename> file in to the <filename>/test/</filename> directory.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>tar -xvf test.tar</command> command to extract the Tar archive.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>ls -lZ /test/</command> command to view the SELinux contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has been retained, rather than being changed to <computeroutput>default_t</computeroutput>, which would have happened had the <option>--selinux</option> not been used:
- </para>
-
+ </step>
+ <step>
+ <para>
+ Change into <filename class="directory">/var/www/html/</filename>. Once in this directory, as root, run the following command to create a <systemitem>tar</systemitem> archive named <filename>test.tar</filename>:
+ </para>
+<screen><prompt>~]$</prompt> <command>cd /var/www/html/</command></screen>
+<screen><prompt>html]#</prompt> <command>tar --selinux -cf test.tar file{1,2,3}</command></screen>
+ </step>
+ <step>
+ <para>
+ As root, create a new directory named <filename class="directory">/test/</filename>, and then allow all users full access to it:
+ </para>
+<screen><prompt>~]#</prompt> <command>mkdir /test</command></screen>
+<screen><prompt>~]#</prompt> <command>chmod 777 /test/</command></screen>
+ </step>
+ <step>
+ <para>
+ Copy the <filename>test.tar</filename> file into <filename class="directory">/test/</filename>:
+ </para>
+<screen><prompt>~]$</prompt> <command>cp /var/www/html/test.tar /test/</command></screen>
+ </step>
+ <step>
+ <para>
+ Change into <filename class="directory">/test/</filename> directory. Once in this directory, run the following command to extract the <systemitem>tar</systemitem> archive:
+ </para>
+<screen><prompt>test]$</prompt> <command>tar -xvf test.tar</command></screen>
+ </step>
+ <step>
+ <para>
+ View the SELinux contexts. The <systemitem>httpd_sys_content_t</systemitem> type has been retained, rather than being changed to <systemitem>default_t</systemitem>, which would have happened had the <option>--selinux</option> not been used:
+ </para>
<screen>
-$ ls -lZ /test/
+<prompt>~]$</prompt> <command>ls -lZ /test/</command>
-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3
-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.tar
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- If the <filename>/test/</filename> directory is no longer required, as the Linux root user, run the <command> rm -ri /test/</command> command to remove it, as well as all files in it.
- </para>
- </listitem>
- </orderedlist>
+ If the <filename class="directory">/test/</filename> directory is no longer required, as root, run the following command to remove it, as well as all files in it:
+ </para>
+<screen><prompt>~]#</prompt> <command>rm -ri /test/</command></screen>
+ </step>
+ </procedure>
<para>
- Refer to the <citerefentry><refentrytitle>tar</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page for further information about <command>tar</command>, such as the <option>--xattrs</option> option that retains all extended attributes.
+ See the <citerefentry><refentrytitle>tar</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page for further information about <systemitem>tar</systemitem>, such as the <option>--xattrs</option> option that retains all extended attributes.
</para>
</section>
<section id="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Archiving_Files_with_star">
- <title>Archiving Files with star</title>
+ <title>Archiving Files with <systemitem>star</systemitem></title>
<para>
- <command>star</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>star -xattr -H=exustar</command> to create archives that retain contexts. The <package>star</package> package is not installed by default. To install <command>star</command>, run the <command>yum install star</command> command as the Linux root user.
+ The <systemitem>star</systemitem> utility does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use the <command>star -xattr -H=exustar</command> command to create archives that retain contexts. The <package>star</package> package is not installed by default. To install <command>star</command>, run the <command>yum install star</command> command as the root user.
</para>
<para>
- The following example demonstrates creating a Star archive that retains SELinux contexts:
+ The following example demonstrates creating a <systemitem>star</systemitem> archive that retains SELinux contexts:
</para>
- <orderedlist>
- <listitem>
+ <procedure id="proc-Security-Enhanced_Linux-Archiving_Files_with_star">
+ <title>Creating a <systemitem>star</systemitem> Archive</title>
+ <step>
<para>
- As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</command> command to create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). These files inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from the <filename>/var/www/html/</filename> directory:
+ As root, create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>) in the <filename class="directory">/var/www/html/</filename>. These files inherit the <systemitem>httpd_sys_content_t</systemitem> type from <filename>/var/www/html/</filename>:
</para>
-
+<screen><prompt>~]#</prompt> <command>touch /var/www/html/file{1,2,3}</command></screen>
<screen>
-# touch /var/www/html/file{1,2,3}
-# ls -Z /var/www/html/
+<prompt>~]#</prompt> <command>ls -Z /var/www/html/</command>
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star file{1,2,3}</command> command to create a Star archive named <filename>test.star</filename>:
+ Change into <filename class="directory">/var/www/html/</filename> directory. Once in this directory, as root, run the following command to create a <systemitem>star</systemitem> archive named <filename>test.star</filename>:
</para>
-
+<screen><prompt>~]$</prompt> <command>cd /var/www/html</command></screen>
<screen>
-# star -xattr -H=exustar -c -f=test.star file{1,2,3}
+<prompt>html]#</prompt> <command>star -xattr -H=exustar -c -f=test.star file{1,2,3}</command>
star: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).
</screen>
- </listitem>
- <listitem>
- <para>
- As the Linux root user, run the <command>mkdir /test</command> command to create a new directory, and then, run the <command>chmod 777 /test/</command> command to allow all users full-access to the <filename>/test/</filename> directory.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>cp /var/www/html/test.star /test/</command> command to copy the <filename>test.star</filename> file in to the <filename>/test/</filename> directory.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>star -x -f=test.star</command> command to extract the Star archive:
- </para>
-
+ </step>
+ <step>
+ <para>
+ As root, create a new directory named <filename class="directory">/test/</filename>, and then allow all users full access to it:
+ </para>
+<screen><prompt>~]#</prompt> <command>mkdir /test</command></screen>
+<screen><prompt>~]#</prompt> <command>chmod 777 /test/</command></screen>
+ </step>
+ <step>
+ <para>
+ Run the following command to copy the <filename>test.star</filename> file into <filename class="directory">/test/</filename>:
+ </para>
+ <screen><prompt>~]$</prompt> <command>cp /var/www/html/test.star /test/</command></screen>
+ </step>
+ <step>
+ <para>
+ Change into <filename class="directory">/test/</filename>. Once in this directory, run the following command to extract the <systemitem>star</systemitem> archive:
+ </para>
+<screen><prompt>~]$</prompt> <command>cd /test/</command></screen>
<screen>
-$ star -x -f=test.star
+<prompt>test]$</prompt> <command>star -x -f=test.star </command>
star: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Run the <command>ls -lZ /test/</command> command to view the SELinux contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has been retained, rather than being changed to <computeroutput>default_t</computeroutput>, which would have happened had the <option>--selinux</option> not been used:
- </para>
-
+ View the SELinux contexts. The <systemitem>httpd_sys_content_t</systemitem> type has been retained, rather than being changed to
+<systemitem>default_t</systemitem>, which would have happened had the <option>-xattr -H=exustar</option> option not been used:
+ </para>
<screen>
-$ ls -lZ /test/
+<prompt>~]$</prompt> <command>ls -lZ /test/</command>
-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3
-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.star
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- If the <filename>/test/</filename> directory is no longer required, as the Linux root user, run the <command> rm -ri /test/</command> command to remove it, as well as all files in it.
- </para>
- </listitem>
- <listitem>
+ If the <filename class="directory">/test/</filename> directory is no longer required, as root, run the following command to remove it, as well as all files in it:
+ </para>
+<screen><prompt>~]#</prompt> <command> rm -ri /test/</command></screen>
+ </step>
+ <step>
<para>
- If <command>star</command> is no longer required, as the Linux root user, run the <command>yum remove star</command> command to remove the package.
- </para>
- </listitem>
- </orderedlist>
+ If <systemitem>star</systemitem> is no longer required, as root, remove the package:
+ </para>
+<screen><prompt>~]#</prompt> <command>yum remove star</command></screen>
+ </step>
+ </procedure>
<para>
- Refer to the <citerefentry><refentrytitle>star</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page for further information about <command>star</command>.
+ See the <citerefentry><refentrytitle>star</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page for further information about <systemitem>star</systemitem>.
</para>
</section>
-</section>
+ </section>
+ <section id="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels-Information_Gathering_Tools">
+ <title>Information Gathering Tools</title>
+ <para>
+ The utilities listed below are command-line tools that provide well-formatted information, such as access vector cache statistics or the number of classes, types, or Booleans.
+ </para>
+ <bridgehead renderas="sect2">avcstat</bridgehead>
+ <para>
+ This command provides a short output of the access vector cache statistics since boot. You can watch the statistics in real time by specifying a time interval in seconds. This provides updated statistics since the initial output. The statistics file used is <filename>/selinux/avc/cache_stats</filename>, and you can specify a different cache file with the <option>-f /path/to/file</option> option.
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>avcstat </command>
+ lookups hits misses allocs reclaims frees
+ 47517410 47504630 12780 12780 12176 12275
+</screen>
+ <bridgehead renderas="sect2">seinfo</bridgehead>
+ <para>
+ This utility is useful in describing the break-down of a policy, such as the number of classes, types, Booleans, allow rules, and others. <systemitem>seinfo</systemitem> is a command-line utility that uses a policy.conf file (a single text file containing policy source for versions 12 through 21), a binary policy file, a modular list of policy packages, or a policy list file as input. You must have the <package>setools-console</package> package installed to use the <systemitem>seinfo</systemitem> utility.
+ </para>
+ <para>
+ The output of <systemitem>seinfo</systemitem> will vary between binary and source files. For example, the policy source file uses the <computeroutput>{ }</computeroutput> brackets to group multiple rule elements onto a single line. A similar effect happens with attributes, where a single attribute expands into one or many types. Because these are expanded and no longer relevant in the binary policy file, they have a return value of zero in the search results. However, the number of rules greatly increases as each formerly one line rule using brackets is now a number of individual lines.
+ </para>
+ <para>
+ Some items are not present in the binary policy. For example, neverallow rules are only checked during policy compile, not during runtime, and initial Security Identifiers (SIDs) are not part of the binary policy since they are required prior to the policy being loaded by the kernel during boot.
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>seinfo</command>
+
+Statistics for policy file: /etc/selinux/targeted/policy/policy.24
+Policy Version & Type: v.24 (binary, mls)
+
+ Classes: 77 Permissions: 229
+ Sensitivities: 1 Categories: 1024
+ Types: 3001 Attributes: 244
+ Users: 9 Roles: 13
+ Booleans: 158 Cond. Expr.: 193
+ Allow: 262796 Neverallow: 0
+ Auditallow: 44 Dontaudit: 156710
+ Type_trans: 10760 Type_change: 38
+ Type_member: 44 Role allow: 20
+ Role_trans: 237 Range_trans: 2546
+ Constraints: 62 Validatetrans: 0
+ Initial SIDs: 27 Fs_use: 22
+ Genfscon: 82 Portcon: 373
+ Netifcon: 0 Nodecon: 0
+ Permissives: 22 Polcap: 2
+</screen>
+ <para>
+ The <systemitem>seinfo</systemitem> utility can also list the number of types with the domain attribute, giving an estimate of the number of different confined processes:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>seinfo -adomain -x | wc -l</command>
+550</screen>
+ <para>
+ Not all domain types are confined. To look at the number of unconfined domains, use the <systemitem>unconfined_domain</systemitem> attribute:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>seinfo -aunconfined_domain_type -x | wc -l</command>
+52
+</screen>
+ <para>
+ Permissive domains can be counted with the <option>--permissive</option> option:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>seinfo --permissive -x | wc -l</command>
+31
+</screen>
+ <para>
+ Remove the additional <command>| wc -l</command> command in the above commands to see the full lists.
+ </para>
+ <bridgehead renderas="sect2">sesearch</bridgehead>
+ <para>
+ You can use the <systemitem>sesearch</systemitem> utility to search for a particular rule in the policy. It is possible to search either policy source files or the binary file. For example:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>sesearch --role_allow -t httpd_sys_content_t /etc/selinux/targeted/policy/policy.24</command>
+Found 20 role allow rules:
+ allow system_r sysadm_r;
+ allow sysadm_r system_r;
+ allow sysadm_r staff_r;
+ allow sysadm_r user_r;
+ allow system_r git_shell_r;
+ allow system_r guest_r;
+ allow logadm_r system_r;
+ allow system_r logadm_r;
+ allow system_r nx_server_r;
+ allow system_r staff_r;
+ allow staff_r logadm_r;
+ allow staff_r sysadm_r;
+ allow staff_r unconfined_r;
+ allow staff_r webadm_r;
+ allow unconfined_r system_r;
+ allow system_r unconfined_r;
+ allow system_r user_r;
+ allow webadm_r system_r;
+ allow system_r webadm_r;
+ allow system_r xguest_r;
+</screen>
+ <para>
+ The <systemitem>sesearch</systemitem> utility can provide the number of <emphasis>allow</emphasis> rules:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>sesearch --allow | wc -l</command>
+262798
+</screen>
+ <para>
+ And the number of <emphasis>dontaudit</emphasis> rules:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>sesearch --dontaudit | wc -l</command>
+156712
+</screen>
+ </section>
+ <section id="mls">
+ <title>Multi-Level Security (MLS)</title>
+ <para>
+ The Multi-Level Security technology refers to a security scheme that enforces the Bell-La Padula Mandatory Access Model. Under MLS, users and processes are called <firstterm>subjects</firstterm>, and files, devices, and other passive components of the system are called <firstterm>objects</firstterm>. Both subjects and objects are labeled with a security level, which entails a subject's clearance or an object's classification. Each security level is composed of a <firstterm>sensitivity</firstterm> and a <firstterm>category</firstterm>, for example, an internal release schedule is filed under the internal documents category with a confidential sensitivity.
+ </para>
+ <para>
+ <xref linkend="fig-mls-levels-of-clearance"/> shows levels of clearance as originally designed by the US defense community. Relating to our internal schedule example above, only users that have gained the confidential clearance are allowed to view documents in the confidential category. However, users who only have the confidential clearance are not allowed to view documents that require higher levels or clearance; they are allowed read access only to documents with lower levels of clearance, and write access to documents with higher levels of clearance.
+ </para>
+ <figure id="fig-mls-levels-of-clearance">
+ <title>Levels of clearance</title>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="images/security-intro-to-mls.png" format="PNG" scalefit="0"/>
+ </imageobject>
+ <textobject>
+ <para>
+ Levels of Clearance
+ </para>
+ </textobject>
+ </mediaobject>
+ </figure>
+ <para>
+ <xref linkend="fig-mls-data-flow"/> shows all allowed data flows between a subject running under the "Secret" security level and various objects with different security levels. In simple terms, the Bell-LaPadula model enforces two properties: <firstterm>no read up</firstterm> and <firstterm>no write down</firstterm>.
+ </para>
+ <figure id="fig-mls-data-flow">
+ <title>Allowed data flows using MLS</title>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="images/security-mls-data-flow.png" format="PNG" scalefit="0"/>
+ </imageobject>
+ <textobject>
+ <para>
+ Allowed data flows using MLS
+ </para>
+ </textobject>
+ </mediaobject>
+ </figure>
+ <section id="MLS-and-system-privileges">
+ <title>MLS and System Privileges</title>
+ <para>
+ MLS access rules are always combined with conventional access permissions (file permissions). For example, if a user with a security level of "Secret" uses Discretionary Access Control (DAC) to block access to a file by other users, this also blocks access by users with a security level of "Top Secret". It is important to remember that SELinux MLS policy rules are checked <emphasis>after</emphasis> DAC rules. A higher security clearance does not automatically give permission to arbitrarily browse a file system.
+ </para>
+ <para>
+ Users with top-level clearances do not automatically acquire administrative rights on multi-level systems. While they may have access to all information on the computer, this is different from having administrative rights.
+ </para>
+ </section>
+ <section id="enabling-mls-in-selinux">
+ <title>Enabling MLS in SELinux</title>
+ <note>
+ <para>
+ It is not recommended to use the MLS policy on a system that is running the X Window System.
+ </para>
+ </note>
+ <para>
+ Follow these steps to enable the SELinux MLS policy on your system.
+ </para>
+ <procedure id="Security-Enhanced_Linux-Enabling_MLS_in_SELinux">
+ <title>Enabling SELinux MLS Policy</title>
+ <step>
+ <para>
+ Install the <package>selinux-policy-mls</package> package:
+ </para>
+<screen><prompt>~]#</prompt> <command>yum install selinux-policy-mls</command></screen>
+ </step>
+ <step>
+ <para>
+ Before the MLS policy is enabled, each file on the file system must be relabeled with an MLS label. When the file system is relabeled, confined domains may be denied access, which may prevent your system from booting correctly. To prevent this from happening, configure <computeroutput>SELINUX=permissive</computeroutput> in the <filename>/etc/selinux/config</filename> file. Also, enable the MLS policy by configuring <computeroutput>SELINUXTYPE=mls</computeroutput>. Your configuration file should look like this:
+ </para>
+<screen>
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+# enforcing - SELinux security policy is enforced.
+# permissive - SELinux prints warnings instead of enforcing.
+# disabled - No SELinux policy is loaded.
+SELINUX=permissive
+# SELINUXTYPE= can take one of these two values:
+# targeted - Targeted processes are protected,
+# mls - Multi Level Security protection.
+SELINUXTYPE=mls
+</screen>
+ </step>
+ <step>
+ <para>
+ Make sure SELinux is running in the permissive mode:
+ </para>
+<screen><prompt>~]#</prompt> <command>setenforce 0</command></screen>
+<screen>
+<prompt>~]$</prompt> <command>getenforce</command>
+Permissive
+</screen>
+ </step>
+ <step>
+ <para>
+ Create the <filename>.autorelabel</filename> file in root's home directory to ensure that files are relabeled upon next reboot:
+ </para>
+<screen><prompt>~]#</prompt> <command>touch /.autorelabel</command></screen>
+ <para>
+ Note that it is necessary to add the <option>-F</option> option to this file. This can be done by executing the following command:
+ </para>
+<screen><prompt>~]#</prompt> <command>echo "-F" >> /.autorelabel</command></screen>
+ </step>
+ <step>
+ <para>
+ Reboot your system. During the next boot, all file systems will be relabeled according to the MLS policy. The label process labels all files with an appropriate SELinux context:
+ </para>
+<screen>
+*** Warning -- SELinux mls policy relabel is required.
+*** Relabeling could take a very long time, depending on file
+*** system size and speed of hard drives.
+***********
+</screen>
+ <para>
+ Each <computeroutput>*</computeroutput> (asterisk) character on the bottom line represents 1000 files that have been labeled. In the above example, eleven <computeroutput>*</computeroutput> characters represent 11000 files which have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes. Once the labeling process finishes, the system will automatically reboot.
+ </para>
+ </step>
+ <step>
+ <para>
+ In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as root, run the following command to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. Refer to <xref linkend="sect-Security-Enhanced_Linux-Troubleshooting" /> for troubleshooting information if SELinux denied access during boot.
+ </para>
+<screen><prompt>~]#</prompt> <command>grep "SELinux is preventing" /var/log/messages</command></screen>
+ </step>
+ <step>
+ <para>
+ If there were no denial messages in the <filename>/var/log/messages</filename> file, or you have resolved all existing denials, configure <computeroutput>SELINUX=enforcing</computeroutput> in the <filename>/etc/selinux/config</filename> file:
+ </para>
+<screen>
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+# enforcing - SELinux security policy is enforced.
+# permissive - SELinux prints warnings instead of enforcing.
+# disabled - No SELinux policy is loaded.
+SELINUX=enforcing
+# SELINUXTYPE= can take one of these two values:
+# targeted - Targeted processes are protected,
+# mls - Multi Level Security protection.
+SELINUXTYPE=mls
+</screen>
+ </step>
+ <step>
+ <para>
+ Reboot your system and make sure SELinux is running in enforcing mode:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>getenforce</command>
+Enforcing
+</screen>
+ <para>
+ and the MLS policy is enabled:
+ </para>
+<screen><prompt>~]#</prompt> <command>sestatus |grep mls</command>
+Policy from config file: mls
+</screen>
+ </step>
+ </procedure>
+ </section>
+ <section id="creating-a-user-with-a-specific-mls-range">
+ <title>Creating a User With a Specific MLS Range</title>
+ <para>
+ Follow these steps to create a new Linux user with a specific MLS range:
+ </para>
+ <procedure id="proc-Security-Enhanced_Linux-Creating_a_User_With_a_Specific_MLS_Range">
+ <title>Creating a User With a Specific MLS Range</title>
+ <step>
+ <para>
+ Add a new Linux user using the <command>useradd</command> command and map the new Linux user to an existing SELinux user (in this case, <systemitem>user_u</systemitem>):
+ </para>
+<screen><prompt>~]#</prompt> <command>useradd -Z user_u john</command></screen>
+ </step>
+ <step>
+ <para>
+ Assign the newly-created Linux user a password:
+ </para>
+<screen>prompt~]# <command>passwd john</command></screen>
+ </step>
+ <step>
+ <para>
+ Run the following command as root to view the mapping between SELinux and Linux users. The output should be as follows:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>semanage login -l</command>
+
+Login Name SELinux User MLS/MCS Range Service
+
+__default__ unconfined_u s0-s0:c0.c1023 *
+john user_u s0 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
+</screen>
+ </step>
+ <step>
+ <para>
+ Define a specific range for user <literal>john</literal>:
+ </para>
+<screen><prompt>~]#</prompt> <command>semanage login --modify --seuser user_u --range s2:c100 john</command></screen>
+ </step>
+ <step>
+ <para>
+ View the mapping between SELinux and Linux users again. Note that the user <literal>john</literal> now has a specific MLS range defined:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>semanage login -l</command>
+
+Login Name SELinux User MLS/MCS Range Service
+
+__default__ unconfined_u s0-s0:c0.c1023 *
+john user_u s2:c100 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
+</screen>
+ </step>
+ <step>
+ <para>
+ To correct the label on john's home directory (if needed), run the following command:
+ </para>
+<screen><prompt>~]#</prompt> <command>chcon -R -l s2:c100 /home/john</command></screen>
+ </step>
+ </procedure>
+ </section>
+ <section id="polyinstantiated-directories">
+ <title>Setting Up Polyinstantiated Directories</title>
+ <para>
+ The <filename class="directory">/tmp/</filename> and <filename class="directory">/var/tmp/</filename> directories are normally used for temporary storage by all programs, services, and users. Such setup, however, makes these directories vulnerable to race condition attacks, or an information leak based on file names. SELinux offers a solution in the form of <firstterm>polyinstantiated</firstterm> directories. This effectively means that both <filename class="directory">/tmp/</filename> and <filename class="directory">/var/tmp/</filename> are instantiated, making them appear private for each user. When instantiation of directories is enabled, each user's <filename class="directory">/tmp/</filename> and <filename class="directory">/var/tmp/</filename> directory is automatically mounted under <filename>/tmp-inst</filename> and <filename>/var/tmp/tmp-inst</filename>.
+ </para>
+ <para>
+ Follow these steps to enable polyinstantiation of directories:
+ </para>
+ <procedure id="proc-Security-Enhanced_Linux-Enabling_Polyinstantiation_Directories">
+ <title>Enabling Polyinstantiation Directories</title>
+ <step>
+ <para>
+ Uncomment the last three lines in the <filename>/etc/security/namespace.conf</filename> file to enable instantiation of the <filename class="directory">/tmp/</filename>, <filename class="directory">/var/tmp/</filename>, and users' home directories:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>tail -n 3 /etc/security/namespace.conf</command>
+/tmp /tmp-inst/ level root,adm
+/var/tmp /var/tmp/tmp-inst/ level root,adm
+$HOME $HOME/$USER.inst/ level
+</screen>
+ </step>
+ <step>
+ <para>
+ Ensure that in the <filename>/etc/pam.d/login</filename> file, the <systemitem>pam_namespace.so</systemitem> module is configured for session:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>grep namespace /etc/pam.d/login</command>
+session required pam_namespace.so
+</screen>
+ </step>
+ <step>
+ <para>
+ Reboot your system.
+ </para>
+ </step>
+ </procedure>
+ </section>
+
+ </section>
+ <section id="sec-file-name-transition">
+ <title>File Name Transition</title>
+ <para>
+ The <firstterm>file name transition</firstterm> feature allows policy writers to specify the file name when writing policy transition rules. It is possible to write a rule that states: If a process labeled <computeroutput>A_t</computeroutput> creates a specified object class in a directory labeled <computeroutput>B_t</computeroutput> and the specified object class is named <literal>objectname</literal>, it gets the label <computeroutput>C_t</computeroutput>. This mechanism provides more fine-grained control over processes on the system.
+ </para>
+ <para>
+ Without file name transition, there are three possible ways how to label an object:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ By default, objects inherit labels from parent directories. For example, if the user creates a file in a directory labeled <systemitem>etc_t</systemitem>, then the file is labeled also <systemitem>etc_t</systemitem>. However, this method is useless when it is desirable to have multiple files within a directory with different labels.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Policy writers can write a rule in policy that states: If a process with type <systemitem>A_t</systemitem> creates a specified object class in a directory labeled <systemitem>B_t</systemitem>, the object gets the new <systemitem>C_t</systemitem> label. This practice is problematic if a single program creates multiple objects in the same directory where each object requires a separate label. Moreover, these rules provide only partial control, because names of the created objects are not specified.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Certain applications have SELinux awareness that allow such an application to ask the system what the label of a certain path should be. These applications then request the kernel to create the object with the required label. Examples of applications with SELinux awareness are the <application>rpm</application> package manager, the <application>restorecon</application> utility, or the <application>udev</application> device manager. However, it is not possible to instruct every application that creates files or directories with SELinux awareness. It is often necessary to relabel objects with the correct label after creating. Otherwise, when a confined domain attempts to use the object, AVC messages are returned.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <para>
+ The file name transition feature decreases problems related to incorrect labeling and improves the system to be more secure. Policy writers are able to state properly that a certain application can only create a file with a specified name in a specified directory. The rules take into account the file name, not the file path. This is the basename of the file path. Note that file name transition uses an exact match done by the <function>strcmp()</function> function. Use of regular expressions or wildcard characters is not considered.
+ </para>
+ <note>
+ <para>
+ File paths can vary in the kernel and file name transition does not use the paths to determine labels. Consequently, this feature only affects initial file creation and does not fix incorrect labels of already created objects.
+ </para>
+ </note>
+ <example id="ex-Examples_of_Policy_Rules_Written_with_File_Name_Transition">
+ <title>Examples of Policy Rules Written with File Name Transition</title>
+ <para>
+ The example below shows a policy rule with file name transition:
+ </para>
+<screen>filetrans_pattern(unconfined_t, admin_home_t, ssh_home_t, dir, ".ssh")</screen>
+ <para>
+ This rule states that if a process with the <systemitem>unconfined_t</systemitem> type creates the <filename class="directory">~/.ssh/</filename> directory in a directory labeled <systemitem>admin_home_t</systemitem>, the <filename class="directory">~/.ssh/</filename> directory gets the label <systemitem>ssh_home_t</systemitem>.
+ </para>
+ <para>
+ Similar examples of policy rules written with file name transition are presented below:
+ </para>
+<screen>
+filetrans_pattern(staff_t, user_home_dir_t, httpd_user_content_t, dir, "public_html")
+filetrans_pattern(thumb_t, user_home_dir_t, thumb_home_t, file, "missfont.log")
+filetrans_pattern(kernel_t, device_t, xserver_misc_device_t, chr_file, "nvidia0")
+filetrans_pattern(puppet_t, etc_t, krb5_conf_t, file, "krb5.conf")
+</screen>
+ </example>
+ <note>
+ <para>
+ The file name transition feature affects mainly policy writers, but users can notice that instead of file objects almost always created with the default label of the containing directory, some file objects have a different label as specified in policy.
+ </para>
+ </note>
+ </section>
+ <section id="sect-Security-Enhanced_Linux-Working_with_SELinux-Disable_ptrace">
+ <title>Disable ptrace()</title>
+ <para>
+ The <systemitem>ptrace()</systemitem> system call allows one process to observe and control the execution of another process and change its memory and registers. This call is used primarily by developers during debugging, for example when using the <systemitem>strace</systemitem> utility. When <systemitem>ptrace()</systemitem> is not needed, it can be disabled to improve system security. This can be done by enabling the <computeroutput>deny_ptrace</computeroutput> Boolean, which denies all processes, even those that are running in <computeroutput>unconfined_t</computeroutput> domains, from being able to use <systemitem>ptrace()</systemitem> on other processes.
+ </para>
+ <para>
+ The <computeroutput>deny_ptrace</computeroutput> Boolean is disabled by default. To enable it, run the <command>setsebool -P deny_ptrace on</command> command as the root user:
+<screen><prompt>~]#</prompt> <command>setsebool -P deny_ptrace on</command></screen>
+ </para>
+ <para>
+ To verify if this Boolean is enabled, use the following command:
+<screen>
+<prompt>~]$</prompt> <command>getsebool deny_ptrace</command>
+deny_ptrace --> on
+</screen>
+ </para>
+ <para>
+ To disable this Boolean, run the <command>setsebool -P deny_ptrace off</command> command as root:
+<screen><prompt>~]#</prompt> <command>setsebool -P deny_ptrace off</command></screen>
+ </para>
+ <note>
+ <para>
+ The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots.
+ </para>
+ </note>
+ <para>
+ This Boolean influences only packages that are part of &PRODUCT;. Consequently, third-party packages could still use the <systemitem>ptrace()</systemitem> system call. To list all domains that are allowed to use <systemitem>ptrace()</systemitem>, run the following command. Note that the <package>setools-console</package> package provides the <systemitem>sesearch</systemitem> utility and that the package is not installed by default.
+ </para>
+<screen><prompt>~]#</prompt> <command>sesearch -A -p ptrace,sys_ptrace -C | grep -v deny_ptrace | cut -d ' ' -f 5</command></screen>
+ </section>
+ <section id="sect-thumbnail_protection">
+ <title>Thumbnail Protection</title>
+ <para>
+ The thumbnail icons can potentially allow an attacker to break into a locked machine using removable media, such as USB devices or CDs. When the system detects a removable media, the Nautilus file manager executes the thumbnail driver code to display thumbnail icons in an appropriate file browser even if the machine is locked. This behavior is unsafe because if the thumbnail executables were vulnerable, the attacker could use the thumbnail driver code to bypass the lock screen without entering the password.
+ </para>
+ <para>
+ Therefore, a new SELinux policy is used to prevent such attacks. This policy ensures that all thumbnail drivers are locked when the screen is locked. The thumbnail protection is enabled for both confined users and unconfined users. This policy affects the following applications:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ /usr/bin/evince-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/ffmpegthumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/gnome-exe-thumbnailer.sh
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/gnome-nds-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/gnome-xcf-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/gsf-office-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/raw-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/shotwell-video-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/totem-video-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/bin/whaaw-thumbnailer
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/lib/tumbler-1/tumblerd
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ /usr/lib64/tumbler-1/tumblerd
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
</section>
diff --git a/en-US/images/security-intro-to-mls.png b/en-US/images/security-intro-to-mls.png
new file mode 100644
index 0000000..2e0fa95
Binary files /dev/null and b/en-US/images/security-intro-to-mls.png differ
diff --git a/en-US/images/security-mls-data-flow.png b/en-US/images/security-mls-data-flow.png
new file mode 100644
index 0000000..a2ecd24
Binary files /dev/null and b/en-US/images/security-mls-data-flow.png differ
9 years, 9 months
[securityguide] Updated Targeted Policy with new content from RHEL7.
by Bara Ančincová
commit 8884f50efb79513436fafefd50206dfd0ee29bce
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Mon Jul 28 14:23:24 2014 +0200
Updated Targeted Policy with new content from RHEL7.
en-US/Snippet_Systemctl_Status.xml | 9 +
en-US/Targeted_Policy.xml | 771 ++++++++++++++++++------------------
2 files changed, 401 insertions(+), 379 deletions(-)
---
diff --git a/en-US/Snippet_Systemctl_Status.xml b/en-US/Snippet_Systemctl_Status.xml
new file mode 100644
index 0000000..3511789
--- /dev/null
+++ b/en-US/Snippet_Systemctl_Status.xml
@@ -0,0 +1,9 @@
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE snippetpartIIbooleansintro PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!ENTITY % BOOK_ENTITIES SYSTEM "SELinux_Users_and_Administrators_Guide.ent">
+%BOOK_ENTITIES;
+]>
+
+<para>
+ Confirm that the service is running. The output should include the information below (only the time stamp will differ):
+</para>
diff --git a/en-US/Targeted_Policy.xml b/en-US/Targeted_Policy.xml
index 94bc8ca..73af791 100644
--- a/en-US/Targeted_Policy.xml
+++ b/en-US/Targeted_Policy.xml
@@ -2,30 +2,31 @@
<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
]>
-<section id="sect-Security-Enhanced_Linux-Targeted_Policy">
+<section id="chap-Security-Enhanced_Linux-Targeted_Policy">
<title>Targeted Policy</title>
<para>
- Targeted policy is the default SELinux policy used in &PRODUCT;. When using targeted policy, processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. For example, by default, logged in users run in the <computeroutput>unconfined_t</computeroutput> domain, and system processes started by init run in the <computeroutput>initrc_t</computeroutput> domain - both of these domains are unconfined.
+ Targeted policy is the default SELinux policy used in &PRODUCT;. When using targeted policy, processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. For example, by default, logged-in users run in the <systemitem>unconfined_t</systemitem> domain, and system processes started by init run in the <systemitem>initrc_t</systemitem> domain; both of these domains are unconfined.
</para>
<para>
- Unconfined domains (as well as confined domains) are subject to executable and writeable memory checks. By default, subjects running in an unconfined domain can not allocate writeable memory and execute it. This reduces vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow">buffer overflow attacks</ulink>. These memory checks are disabled by setting Booleans, which allow the SELinux policy to be modified at runtime. Boolean configuration is discussed later.
+ Unconfined domains (as well as confined domains) are subject to executable and writeable memory checks. By default, subjects running in an unconfined domain cannot allocate writeable memory and execute it. This reduces vulnerability to buffer overflow attacks. These memory checks are disabled by setting Booleans, which allow the SELinux policy to be modified at runtime. Boolean configuration is discussed later.
</para>
<section id="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_Processes">
<title>Confined Processes</title>
<para>
- Almost every service that listens on a network is confined in &PRODUCT;. Also, most processes that run as the Linux root user and perform tasks for users, such as the <application>passwd</application> application, are confined. When a process is confined, it runs in its own domain, such as the <systemitem class="daemon">httpd</systemitem> process running in the <computeroutput>httpd_t</computeroutput> domain. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited.
- </para>
- <para>
- The following example demonstrates how SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from reading files that are not correctly labeled, such as files intended for use by Samba. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:
- </para>
- <orderedlist>
- <listitem>
+ Almost every service that listens on a network, such as <systemitem class="daemon">sshd</systemitem> or <systemitem class="daemon">httpd</systemitem>, is confined in &PRODUCT;. Also, most processes that run as the root user and perform tasks for users, such as the <systemitem>passwd</systemitem> utility, are confined. When a process is confined, it runs in its own domain, such as the <systemitem class="daemon">httpd</systemitem> process running in the <systemitem>httpd_t</systemitem> domain. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited.
+ </para>
+
+ <para>
+ Complete this procedure to ensure that SELinux is enabled and the system is prepared to perform the following example:
+ </para>
+ <procedure id="proc-How_to_Verify_SELinux_Status">
+ <title>How to Verify SELinux Status</title>
+ <step>
<para>
- Run the <command>sestatus</command> command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used:
+ Confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used. The correct output should look similar to the output below:
</para>
-
<screen>
-$ /usr/sbin/sestatus
+<prompt>~]$</prompt> <command>sestatus</command>
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
@@ -33,113 +34,119 @@ Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted
</screen>
+ <para>
+ See <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" /> for detailed information about enabling and disabling SELinux.
+ </para>
+ </step>
+ <step>
<para>
- <computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used.
- </para>
- </listitem>
- <listitem>
- <para>
- As the Linux root user, run the <command>touch /var/www/html/testfile</command> command to create a file.
- </para>
- </listitem>
- <listitem>
+ As root, create a file in the <filename class="directory">/var/www/html/</filename> directory:
+ </para>
+<screen><prompt>~]#</prompt> <command>touch /var/www/html/testfile</command></screen>
+ </step>
+ <step>
<para>
- Run the <command>ls -Z /var/www/html/testfile</command> command to view the SELinux context:
+ Run the following command to view the SELinux context of the newly created file:
</para>
-
-<screen>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/testfile
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /var/www/html/testfile</command>
+-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/testfile
</screen>
<para>
- By default, Linux users run unconfined in &PRODUCT;, which is why the <filename>testfile</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote>
- <para>
- When using other policies, such as MLS, other roles may be used, for example, <computeroutput>secadm_r</computeroutput>.
+ By default, Linux users run unconfined in &PRODUCT;, which is why the <filename>testfile</filename> file is labeled with the SELinux <systemitem>unconfined_u</systemitem> user. RBAC is used for processes, not files. Roles do not have a meaning for files; the <systemitem>object_r</systemitem> role is a generic role used for files (on persistent storage and network file systems). Under the <filename class="directory">/proc/</filename> directory, files related to processes may use the <systemitem>system_r</systemitem> role.<footnote>
+ <para>
+ When using other policies, such as MLS, other roles may be used, for example, <systemitem>secadm_r</systemitem>.
</para>
- </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file.
+ </footnote> The <systemitem>httpd_sys_content_t</systemitem> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file.
</para>
- </listitem>
- <listitem>
+ </step>
+ </procedure>
+ <para>
+ The following example demonstrates how SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from reading files that are not correctly labeled, such as files intended for use by Samba. This is an example, and should not be used in production. It assumes that the <package>httpd</package> and <package>wget</package> packages are installed, the SELinux targeted policy is used, and that SELinux is running in enforcing mode.
+ </para>
+ <procedure>
+ <title>An Example of Confined Process</title>
+ <step>
<para>
- As the Linux root user, run the <command>service httpd start</command> command to start the <systemitem class="daemon">httpd</systemitem> process. The output is as follows if <systemitem class="daemon">httpd</systemitem> starts successfully:
+ As root, start the <systemitem class="daemon">httpd</systemitem> daemon:
</para>
-
-<screen># /sbin/service httpd start
-Starting httpd: [ OK ]
+<screen>
+<prompt>~]#</prompt> <command>systemctl start httpd.service</command>
</screen>
- </listitem>
- <listitem>
+<xi:include href="Snippet_Systemctl_Status.xml" xmlns:xi="http://www.w3.org/2001/XInclude" />
+<screen><prompt>~]$</prompt> <command>systemctl status httpd.service</command>
+httpd.service - The Apache HTTP Server
+ Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
+ Active: active (running) since Mon 2013-08-05 14:00:55 CEST; 8s ago
+</screen>
+ </step>
+ <step>
<para>
- Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command succeeds:
+ Change into a directory where your Linux user has write access to, and run the following command. Unless there are changes to the default configuration, this command succeeds:
</para>
<screen>
-$ wget http://localhost/testfile
-
---2010-05-11 13:19:07-- http://localhost/testfile
-Resolving localhost... ::1, 127.0.0.1
-Connecting to localhost|::1|:80... connected.
+<prompt>~]$</prompt> <command>wget http://localhost/testfile</command>
+--2009-11-06 17:43:01-- http://localhost/testfile
+Resolving localhost... 127.0.0.1
+Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 0 [text/plain]
-Saving to: “testfile”
-
- [ <=> ] 0 --.-K/s in 0s
+Saving to: `testfile'
-2010-05-11 13:19:07 (0.00 B/s) - “testfile” saved [0/0]
+[ <=> ] 0 --.-K/s in 0s
+
+2009-11-06 17:43:01 (0.00 B/s) - `testfile' saved [0/0]
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <command>semanage</command> command, which is discussed later. As the Linux root user, run the following command to change the type to a type used by Samba:
- </para>
- <para>
- <command>chcon -t samba_share_t /var/www/html/testfile</command>
+ The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <systemitem>semanage</systemitem> utility, which is discussed later. As root, run the following command to change the type to a type used by Samba:
</para>
+ <screen><prompt>~]#</prompt> <command>chcon -t samba_share_t /var/www/html/testfile</command>
+ </screen>
+
<para>
- Run the <command>ls -Z /var/www/html/testfile</command> command to view the changes:
+ Run the following command to view the changes:
</para>
-
-<screen>-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /var/www/html/testfile</command>
+-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Note: the current DAC permissions allow the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename>. Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command fails:
+ Note that the current DAC permissions allow the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename>. Change into a directory where your user has write access to, and run the following command. Unless there are changes to the default configuration, this command fails:
</para>
-
<screen>
-$ wget http://localhost/testfile
-
---2010-05-11 13:23:49-- http://localhost/testfile
-Resolving localhost... ::1, 127.0.0.1
-Connecting to localhost|::1|:80... connected.
+<prompt>~]$</prompt> <command>wget http://localhost/testfile</command>
+--2009-11-06 14:11:23-- http://localhost/testfile
+Resolving localhost... 127.0.0.1
+Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
-2010-05-11 13:23:49 ERROR 403: Forbidden.
+2009-11-06 14:11:23 ERROR 403: Forbidden.
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>rm -i /var/www/html/testfile</command> command to remove <filename>testfile</filename>.
- </para>
- </listitem>
- <listitem>
+ As root, remove <filename>testfile</filename>:
+ </para>
+<screen><prompt>~]#</prompt> <command>rm -i /var/www/html/testfile</command></screen>
+ </step>
+ <step>
<para>
- If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as the Linux root user, run the <command>service httpd stop</command> command to stop <systemitem class="daemon">httpd</systemitem>:
+ If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as root, run the following command to stop it:
</para>
-
-<screen># /sbin/service httpd stop
-Stopping httpd: [ OK ]
-</screen>
- </listitem>
- </orderedlist>
- <para>
- This example demonstrates the additional security added by SELinux. Although DAC rules allowed the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename> in step 7, because the file was labeled with a type that the <systemitem class="daemon">httpd</systemitem> process does not have access to, SELinux denied access. After step 7, an error similar to the following is logged to <filename>/var/log/messages</filename>:
- </para>
-
<screen>
-May 11 13:23:51 localhost setroubleshoot: SELinux is preventing /usr/sbin/httpd "getattr" access to /var/www/html/testfile. For complete SELinux messages. run sealert -l ca2ab0df-fcb9-46d1-8283-037450d1efcc
+<prompt>~]#</prompt> <command>systemctl stop httpd.service</command>
</screen>
+ </step>
+ </procedure>
+ <para>
+ This example demonstrates the additional security added by SELinux. Although DAC rules allowed the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename> in step 2, because the file was labeled with a type that the <systemitem class="daemon">httpd</systemitem> process does not have access to, SELinux denied access.
+ </para>
<para>
- Previous log files may use a <filename>/var/log/messages.<replaceable>YYYYMMDD</replaceable></filename> format. When running <application>syslog-ng</application>, previous log files may use a <filename>/var/log/messages.<replaceable>X</replaceable></filename> format. If the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> processes are running, errors similar to the following are logged to <filename>/var/log/audit/audit.log</filename>:
+ If the <systemitem class="daemon">auditd</systemitem> daemon is running, an error similar to the following is logged to <filename>/var/log/audit/audit.log</filename>:
</para>
-
<screen>type=AVC msg=audit(1220706212.937:70): avc: denied { getattr } for pid=1904 comm="httpd" path="/var/www/html/testfile" dev=sda5 ino=247576 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 success=no exit=-13 a0=b9e21da0 a1=bf9581dc a2=555ff4 a3=2008171 items=0 ppid=1902 pid=1904 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
@@ -148,199 +155,163 @@ type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 success=no
Also, an error similar to the following is logged to <filename>/var/log/httpd/error_log</filename>:
</para>
-<screen>[Tue May 11 13:23:49 2010] [error] [client <replaceable>::1</replaceable>] (13)Permission denied: access to /testfile denied
+<screen>[Wed May 06 23:00:54 2009] [error] [client <replaceable>127.0.0.1</replaceable>] (13)Permission denied: access to /testfile denied
</screen>
</section>
<section id="sect-Security-Enhanced_Linux-Targeted_Policy-Unconfined_Processes">
<title>Unconfined Processes</title>
<para>
- Unconfined processes run in unconfined domains, for example, init programs run in the unconfined <computeroutput>initrc_t</computeroutput> domain, unconfined kernel processes run in the <computeroutput>kernel_t</computeroutput> domain, and unconfined Linux users run in the <computeroutput>unconfined_t</computeroutput> domain. For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them.
- </para>
- <para>
- The following example demonstrates how the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) can access data intended for use by Samba, when running unconfined. Note: in &PRODUCT;, the <systemitem class="daemon">httpd</systemitem> process runs in the confined <computeroutput>httpd_t</computeroutput> domain by default. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:
+ Unconfined processes run in unconfined domains, for example, init programs run in the unconfined <systemitem>initrc_t</systemitem> domain, unconfined kernel processes run in the <systemitem>kernel_t</systemitem> domain, and unconfined Linux users run in the <systemitem>unconfined_t</systemitem> domain. For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules – it does not replace them.
</para>
- <orderedlist>
- <listitem>
- <para>
- Run the <command>sestatus</command> command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used:
- </para>
-
-<screen>
-$ /usr/sbin/sestatus
-SELinux status: enabled
-SELinuxfs mount: /selinux
-Current mode: enforcing
-Mode from config file: enforcing
-Policy version: 24
-Policy from config file: targeted
-</screen>
- <para>
- <computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used.
- </para>
- </listitem>
- <listitem>
- <para>
- As the Linux root user, run the <command>touch /var/www/html/test2file</command> command to create a file.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>ls -Z /var/www/html/test2file</command> command to view the SELinux context:
- </para>
-
-<screen>-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/test2file
-</screen>
- <para>
- By default, Linux users run unconfined in &PRODUCT;, which is why the <filename>test2file</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote>
- <para>
- When using other policies, such as MLS, other roles may also be used, for example, <computeroutput>secadm_r</computeroutput>.
- </para>
- </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file.
- </para>
- </listitem>
- <listitem>
- <para>
- The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <command>semanage</command> command, which is discussed later. As the Linux root user, run the following command to change the type to a type used by Samba:
- </para>
- <para>
- <command>chcon -t samba_share_t /var/www/html/test2file</command>
- </para>
+ <para>
+ To ensure that SELinux is enabled and the system is prepared to perform the following example, complete the <xref linkend="proc-How_to_Verify_SELinux_Status" /> described in <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_Processes" />.
+ </para>
+ <para>
+ The following example demonstrates how the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) can access data intended for use by Samba, when running unconfined. Note that in &PRODUCT;, the <systemitem class="daemon">httpd</systemitem> process runs in the confined <systemitem>httpd_t</systemitem> domain by default. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode.
+ </para>
+ <procedure>
+ <title>An Example of Unconfined Process</title>
+ <step>
+ <para>
+ The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <systemitem>semanage</systemitem> utility, which is discussed later. As the root user, run the following command to change the type to a type used by Samba:
+ </para>
+ <screen><prompt>~]#</prompt> <command>chcon -t samba_share_t /var/www/html/testfile</command>
+ </screen>
+
<para>
- Run the <command>ls -Z /var/www/html/test2file</command> command to view the changes:
+ View the changes:
</para>
-
-<screen>-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/test2file
-</screen>
- </listitem>
- <listitem>
+<screen><prompt>~]$</prompt> <command>ls -Z /var/www/html/testfile</command>
+-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile</screen>
+ </step>
+ <step>
<para>
- Run the <command>service httpd status</command> command to confirm that the <systemitem class="daemon">httpd</systemitem> process is not running:
+ Run the following command to confirm that the <systemitem class="daemon">httpd</systemitem> process is not running:
</para>
-<screen>$ /sbin/service httpd status
-httpd is stopped
-</screen>
+<screen><prompt>~]$</prompt> <command>systemctl status httpd.service</command>
+httpd.service - The Apache HTTP Server
+ Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
+ Active: inactive (dead)</screen>
<para>
- If the output differs, run the <command>service httpd stop</command> command as the Linux root user to stop the <systemitem class="daemon">httpd</systemitem> process:
+ If the output differs, run the following command as root to stop the <systemitem class="daemon">httpd</systemitem> process:
</para>
-<screen># /sbin/service httpd stop
-Stopping httpd: [ OK ]
-</screen>
- </listitem>
- <listitem>
- <para>
- To make the <systemitem class="daemon">httpd</systemitem> process run unconfined, run the following command as the Linux root user to change the type of <filename>/usr/sbin/httpd</filename>, to a type that does not transition to a confined domain:
- </para>
+<screen><prompt>~]#</prompt> <command>systemctl stop httpd.service</command></screen>
+ </step>
+ <step>
<para>
- <command>chcon -t unconfined_exec_t /usr/sbin/httpd</command>
+ To make the <systemitem class="daemon">httpd</systemitem> process run unconfined, run the following command as root to change the type of the <filename>/usr/sbin/httpd</filename> file, to a type that does not transition to a confined domain:
</para>
- </listitem>
- <listitem>
+<screen><prompt>~]#</prompt> <command>chcon -t unconfined_exec_t /usr/sbin/httpd</command></screen>
+ </step>
+ <step>
<para>
- Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>unconfined_exec_t</computeroutput> type:
+ Confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <systemitem>unconfined_exec_t</systemitem> type:
</para>
-
-<screen>-rwxr-xr-x root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /usr/sbin/httpd</command>
+-rwxr-xr-x root root system_u:object_r:unconfined_exec_t:s0 /usr/sbin/httpd
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>service httpd start</command> command to start the <systemitem class="daemon">httpd</systemitem> process. The output is as follows if <systemitem class="daemon">httpd</systemitem> starts successfully:
- </para>
-
-<screen># /sbin/service httpd start
-Starting httpd: [ OK ]
+ As root, start the <systemitem class="daemon">httpd</systemitem> process and confirm, that it started successfully:
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>systemctl start httpd.service</command>
</screen>
- </listitem>
- <listitem>
- <para>
- Run the <command>ps -eZ | grep httpd</command> command to view the <systemitem class="daemon">httpd</systemitem> running in the <computeroutput>unconfined_t</computeroutput> domain:
- </para>
-
-<screen>$ ps -eZ | grep httpd
-unconfined_u:system_r:unconfined_t <replaceable>7721</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7723</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7724</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7725</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7726</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7727</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7728</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7729</replaceable> ? 00:00:00 httpd
-unconfined_u:system_r:unconfined_t <replaceable>7730</replaceable> ? 00:00:00 httpd
+<screen>
+<prompt>~]#</prompt> <command>systemctl status httpd.service</command>
+httpd.service - The Apache HTTP Server
+ Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
+ Active: active (running) since Thu 2013-08-15 11:17:01 CEST; 5s ago
</screen>
- </listitem>
- <listitem>
- <para>
- Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/test2file</command> command. Unless there are changes to the default configuration, this command succeeds:
+ </step>
+ <step>
+ <para>
+ Run the following command to view <systemitem class="daemon">httpd</systemitem> running in the <systemitem>unconfined_t</systemitem> domain:
+ </para>
+<screen><prompt>~]$</prompt> <command>ps -eZ | grep httpd</command>
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7721</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7723</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7724</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7725</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7726</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7727</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7728</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7729</replaceable> ? 00:00:00 httpd
+unconfined_u:unconfined_r:unconfined_t:s0 <replaceable>7730</replaceable> ? 00:00:00 httpd</screen>
+ </step>
+ <step>
+ <para>
+ Change into a directory where your Linux user has write access to, and run the following command. Unless there are changes to the default configuration, this command succeeds:
</para>
-<screen>--2009-05-07 01:41:10-- http://localhost/test2file
+<screen><prompt>~]$</prompt> <command>wget http://localhost/testfile</command>
+--2009-05-07 01:41:10-- http://localhost/testfile
Resolving localhost... 127.0.0.1
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 0 [text/plain]
-Saving to: `test2file.1'
+Saving to: `testfile.1'
[ <=> ]--.-K/s in 0s
-2009-05-07 01:41:10 (0.00 B/s) - `test2file.1' saved [0/0]
-</screen>
+2009-05-07 01:41:10 (0.00 B/s) - `testfile.1' saved [0/0]</screen>
<para>
- Although the <systemitem class="daemon">httpd</systemitem> process does not have access to files labeled with the <computeroutput>samba_share_t</computeroutput> type, <systemitem class="daemon">httpd</systemitem> is running in the unconfined <computeroutput>unconfined_t</computeroutput> domain, and falls back to using DAC rules, and as such, the <command>wget</command> command succeeds. Had <systemitem class="daemon">httpd</systemitem> been running in the confined <computeroutput>httpd_t</computeroutput> domain, the <command>wget</command> command would have failed.
+ Although the <systemitem class="daemon">httpd</systemitem> process does not have access to files labeled with the <systemitem>samba_share_t</systemitem> type, <systemitem class="daemon">httpd</systemitem> is running in the unconfined <systemitem>unconfined_t</systemitem> domain, and falls back to using DAC rules, and as such, the <command>wget</command> command succeeds. Had <systemitem class="daemon">httpd</systemitem> been running in the confined <systemitem>httpd_t</systemitem> domain, the <command>wget</command> command would have failed.
</para>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- The <command>restorecon</command> command restores the default SELinux context for files. As the Linux root user, run the <command>restorecon -v /usr/sbin/httpd</command> command to restore the default SELinux context for <filename>/usr/sbin/httpd</filename>:
+ The <systemitem>restorecon</systemitem> utility restores the default SELinux context for files. As root, run the following command to restore the default SELinux context for <filename>/usr/sbin/httpd</filename>:
</para>
-<screen># /sbin/restorecon -v /usr/sbin/httpd
-restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_notrans_exec_t:s0->system_u:object_r:httpd_exec_t:s0
+<screen><prompt>~]#</prompt> <command>restorecon -v /usr/sbin/httpd</command>
+restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_exec_t:s0->system_u:object_r:httpd_exec_t:s0
</screen>
<para>
- Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>httpd_exec_t</computeroutput> type:
+ Confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <systemitem>httpd_exec_t</systemitem> type:
</para>
-
-<screen>$ ls -Z /usr/sbin/httpd
--rwxr-xr-x root root system_u:object_r:httpd_exec_t /usr/sbin/httpd
-</screen>
- </listitem>
- <listitem>
+<screen><prompt>~]$</prompt> <command>ls -Z /usr/sbin/httpd</command>
+-rwxr-xr-x root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd</screen>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>/sbin/service httpd restart</command> command to restart <systemitem class="daemon">httpd</systemitem>. After restarting, run the <command>ps -eZ | grep httpd</command> to confirm that <systemitem class="daemon">httpd</systemitem> is running in the confined <computeroutput>httpd_t</computeroutput> domain:
+ As root, run the following command to restart <systemitem class="daemon">httpd</systemitem>. After restarting, confirm that <systemitem class="daemon">httpd</systemitem> is running in the confined <systemitem>httpd_t</systemitem> domain:
</para>
-<screen># /sbin/service httpd restart
-Stopping httpd: [ OK ]
-Starting httpd: [ OK ]
-# ps -eZ | grep httpd
-unconfined_u:system_r:httpd_t 8880 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8882 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8883 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8884 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8885 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8886 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8887 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8888 ? 00:00:00 httpd
-unconfined_u:system_r:httpd_t 8889 ? 00:00:00 httpd
+<screen>
+<prompt>~]#</prompt> <command>systemctl restart httpd.service</command>
</screen>
- </listitem>
- <listitem>
+<screen>
+<prompt>~]$</prompt> <command>ps -eZ | grep httpd</command>
+system_u:system_r:httpd_t:s0 8883 ? 00:00:00 httpd
+system_u:system_r:httpd_t:s0 8884 ? 00:00:00 httpd
+system_u:system_r:httpd_t:s0 8885 ? 00:00:00 httpd
+system_u:system_r:httpd_t:s0 8886 ? 00:00:00 httpd
+system_u:system_r:httpd_t:s0 8887 ? 00:00:00 httpd
+system_u:system_r:httpd_t:s0 8888 ? 00:00:00 httpd
+system_u:system_r:httpd_t:s0 8889 ? 00:00:00 httpd
+</screen>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>rm -i /var/www/html/test2file</command> command to remove <filename>test2file</filename>.
+ As root, remove <filename>testfile</filename>:
</para>
- </listitem>
- <listitem>
+<screen>
+<prompt>~]#</prompt> <command>rm -i /var/www/html/testfile</command>
+rm: remove regular empty file `/var/www/html/testfile'? y
+</screen>
+ </step>
+ <step>
<para>
- If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as the Linux root user, run the <command>service httpd stop</command> command to stop <systemitem class="daemon">httpd</systemitem>:
+ If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as root, run the following command to stop <systemitem class="daemon">httpd</systemitem>:
</para>
-
-<screen># /sbin/service httpd stop
-Stopping httpd: [ OK ]
-</screen>
- </listitem>
- </orderedlist>
+<screen><prompt>~]#</prompt> <command>systemctl stop httpd.service</command></screen>
+ </step>
+ </procedure>
<para>
The examples in these sections demonstrate how data can be protected from a compromised confined-process (protected by SELinux), as well as how data is more accessible to an attacker from a compromised unconfined-process (not protected by SELinux).
</para>
@@ -349,208 +320,250 @@ Stopping httpd: [ OK ]
<section id="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users">
<title>Confined and Unconfined Users</title>
<para>
- Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions on SELinux users. This Linux user mapping is seen by running the <command>semanage login -l</command> command as the Linux root user:
+ Each Linux user is mapped to an SELinux user using SELinux policy. This allows Linux users to inherit the restrictions on SELinux users. This Linux user mapping is seen by running the <command>semanage login -l</command> command as root:
</para>
-<screen># /usr/sbin/semanage login -l
+<screen><prompt>~]#</prompt> <command>semanage login -l</command>
-Login Name SELinux User MLS/MCS Range
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
<para>
- In &PRODUCT; &PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). The following defines the default-mapping:
+ In &PRODUCT;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default, which is mapped to the SELinux <systemitem>unconfined_u</systemitem> user. The following line defines the default mapping:
</para>
<screen>__default__ unconfined_u s0-s0:c0.c1023
</screen>
<para>
- The following example demonstrates adding a new Linux user, and that Linux user being mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. It assumes that the Linux root user is running unconfined, as it does by default in &PRODUCT; &PRODVER;:
+ The following procedure demonstrates how to add a new Linux user to the system and how to map that user to the SELinux <systemitem>unconfined_u</systemitem> user. It assumes that the root user is running unconfined, as it does by default in &PRODUCT;:
</para>
- <orderedlist>
- <listitem>
+
+ <procedure id="proc-confined-and-unconfined-users-mapping-users-to-SELinux-mapping">
+ <title>Mapping a New Linux User to the SELinux <systemitem>unconfined_u</systemitem> User</title>
+ <step>
<para>
- As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user named newuser.
- </para>
- </listitem>
- <listitem>
+ As root, run the following command to create a new Linux user named <literal>newuser</literal>:
+ </para>
+ <screen><prompt>~]#</prompt> <command>useradd newuser</command></screen>
+ </step>
+ <step>
<para>
- As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:
+ To assign a password to the Linux <literal>newuser</literal> user. Run the following command as root:
</para>
-
-<screen># passwd newuser
+<screen><prompt>~]#</prompt> <command>passwd newuser</command>
Changing password for user newuser.
New UNIX password: <replaceable>Enter a password</replaceable>
Retype new UNIX password: <replaceable>Enter the same password again</replaceable>
passwd: all authentication tokens updated successfully.
</screen>
- </listitem>
- <listitem>
+ </step>
+ <step>
<para>
- Log out of your current session, and log in as the Linux newuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, unconfined_u), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:
+ Log out of your current session, and log in as the Linux <literal>newuser</literal> user. When you log in, the <application>pam_selinux</application> PAM module automatically maps the Linux user to an SELinux user (in this case, <systemitem>unconfined_u</systemitem>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the following command to view the context of a Linux user:
</para>
-<screen>[newuser@localhost ~]$ id -Z
+<screen><prompt>[newuser@localhost ~]$</prompt> <command>id -Z</command>
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
</screen>
- </listitem>
- <listitem>
+ <note>
<para>
- Log out of the Linux newuser's session, and log in with your account. If you do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r newuser</command> command as the Linux root user to remove it, along with the Linux newuser's home directory.
+ If you no longer need the <literal>newuser</literal> user on your system, log out of the Linux <literal>newuser</literal>'s session, log in with your account, and run the <command>userdel -r newuser</command> command as root. It will remove <literal>newuser</literal> along with their home directory.
</para>
- </listitem>
- </orderedlist>
+ </note>
+ </step>
+ </procedure>
+
<para>
- Confined and unconfined Linux users are subject to executable and writeable memory checks, and are also restricted by MCS (and MLS, if the MLS policy is used). If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application.
+ Confined and unconfined Linux users are subject to executable and writeable memory checks, and are also restricted by MCS or MLS.
</para>
<para>
- The following confined SELinux users are available in &PRODUCT; &PRODVER;:
+ If an unconfined Linux user executes an application that SELinux policy defines as one that can transition from the <systemitem>unconfined_t</systemitem> domain to its own confined domain, the unconfined Linux user is still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined. Therefore, the exploitation of a flaw in the application can be limited by the policy.
</para>
+ <para>
+ Similarly, we can apply these checks to confined users. However, each confined Linux user is restricted by a confined user domain against the <systemitem>unconfined_t</systemitem> domain. The SELinux policy can also define a transition from a confined user domain to its own target confined domain. In such a case, confined Linux users are subject to the restrictions of that target confined domain. The main point is that special privileges are associated with the confined users according to their role. In the table below, you can see examples of basic confined domains for Linux users in &PRODUCT;:
+ </para>
+
<table frame="all" id="tabl-Security-Enhanced_Linux-Confined_and_Unconfined_Users-SELinux_User_Capabilities">
- <title>SELinux User Capabilities</title>
- <tgroup cols="6">
- <thead>
- <row>
- <entry>
- User
- </entry>
- <entry>
- Domain
- </entry>
- <entry>
- X Window System
- </entry>
- <entry>
- su and sudo
- </entry>
- <entry>
- Execute in home directory and /tmp/
- </entry>
- <entry>
- Networking
- </entry>
- </row>
- </thead>
- <tbody>
- <row>
- <entry>
- guest_u
- </entry>
- <entry>
- guest_t
- </entry>
- <entry align="center">
- no
- </entry>
- <entry align="center">
- no
- </entry>
- <entry align="center">
- optional
- </entry>
- <entry align="center">
- no
- </entry>
- </row>
- <row>
- <entry>
- xguest_u
- </entry>
- <entry>
- xguest_t
- </entry>
- <entry align="center">
- yes
- </entry>
- <entry align="center">
- no
- </entry>
- <entry align="center">
- optional
- </entry>
- <entry align="center">
- only <application>Firefox</application>
- </entry>
- </row>
- <row>
- <entry>
- user_u
- </entry>
- <entry>
- user_t
- </entry>
- <entry align="center">
- yes
- </entry>
- <entry align="center">
- no
- </entry>
- <entry align="center">
- optional
- </entry>
- <entry align="center">
- yes
- </entry>
- </row>
- <row>
- <entry>
- staff_u
- </entry>
- <entry>
- staff_t
- </entry>
- <entry align="center">
- yes
- </entry>
- <entry align="center">
- only <command>sudo</command>
- </entry>
- <entry align="center">
- optional
- </entry>
- <entry align="center">
- yes
- </entry>
- </row>
- </tbody>
- </tgroup>
+ <title>SELinux User Capabilities</title>
+ <tgroup cols="6">
+ <thead>
+ <row>
+ <entry>
+ User
+ </entry>
+ <entry>
+ Domain
+ </entry>
+ <entry>
+ X Window System
+ </entry>
+ <entry>
+ su or sudo
+ </entry>
+ <entry>
+ Execute in home directory and /tmp/ (default)
+ </entry>
+ <entry>
+ Networking
+ </entry>
+ </row>
+ </thead>
+
+ <tbody>
+ <row>
+ <entry>
+ sysadm_u
+ </entry>
+ <entry>
+ sysadm_t
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ <application>su </application> and <application>sudo</application>
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ </row>
+ <row>
+ <entry>
+ staff_u
+ </entry>
+ <entry>
+ staff_t
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ only <application>sudo</application>
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ </row>
+ <row>
+ <entry>
+ user_u
+ </entry>
+ <entry>
+ user_t
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ no
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ </row>
+ <row>
+ <entry>
+ guest_u
+ </entry>
+ <entry>
+ guest_t
+ </entry>
+ <entry align="center">
+ no
+ </entry>
+ <entry align="center">
+ no
+ </entry>
+ <entry align="center">
+ no
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ </row>
+ <row>
+ <entry>
+ xguest_u
+ </entry>
+ <entry>
+ xguest_t
+ </entry>
+ <entry align="center">
+ yes
+ </entry>
+ <entry align="center">
+ no
+ </entry>
+ <entry align="center">
+ no
+ </entry>
+ <entry align="center">
+ Firefox only
+ </entry>
+ </row>
+ </tbody>
+ </tgroup>
</table>
<itemizedlist>
<listitem>
<para>
- Linux users in the <computeroutput>guest_t</computeroutput>, <computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</computeroutput> domains can only run set user ID (setuid) applications if SELinux policy permits it (such as <command>passwd</command>). They can not run the <command>su</command> and <command>/usr/bin/sudo</command> setuid applications, and therefore, can not use these applications to become the Linux root user.
+ Linux users in the <systemitem>user_t</systemitem>, <systemitem>guest_t</systemitem>, <systemitem>xguest_t</systemitem>, and <systemitem>git_shell_t</systemitem> domains can only run set user ID (setuid) applications if SELinux policy permits it (for example, <systemitem>passwd</systemitem>). These users cannot run the <command>su</command> and <command>sudo</command> setuid applications, and therefore cannot use these applications to become root.
</para>
</listitem>
<listitem>
<para>
- Linux users in the <computeroutput>guest_t</computeroutput> domain have no network access, and can only log in via a terminal (including <systemitem class="daemon">ssh</systemitem>; they can log in via <systemitem class="daemon">ssh</systemitem>, but can not use <systemitem class="daemon">ssh</systemitem> to connect to another system).
+ Linux users in the <systemitem>sysadm_t</systemitem>, <systemitem>staff_t</systemitem>, <systemitem>user_t</systemitem>, and <systemitem>xguest_t</systemitem> domains can log in via the X Window System and a terminal.
</para>
</listitem>
<listitem>
<para>
- The only network access Linux users in the <computeroutput>xguest_t</computeroutput> domain have is <application>Firefox</application> connecting to web pages.
+ By default, Linux users in the <systemitem>guest_t</systemitem> and <systemitem>xguest_t</systemitem> domains cannot execute applications in their home directories or the <filename class="directory">/tmp/</filename> directory, preventing them from executing applications, which inherit users' permissions, in directories they have write access to. This helps prevent flawed or malicious applications from modifying users' files.
</para>
</listitem>
<listitem>
<para>
- Linux users in the <computeroutput>xguest_t</computeroutput>, <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can log in via the X Window System and a terminal.
+ By default, Linux users in the <systemitem>staff_t</systemitem> and <systemitem>user_t</systemitem> domains can execute applications in their home directories and <filename class="directory">/tmp/</filename>. See <xref linkend="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications" /> for information about allowing and preventing users from executing applications in their home directories and <filename class="directory">/tmp/</filename>.
</para>
</listitem>
<listitem>
<para>
- By default, Linux users in the <computeroutput>staff_t</computeroutput> domain do not have permissions to execute applications with <command>/usr/bin/sudo</command>. These permissions must be configured by an administrator.
+ The only network access Linux users in the <systemitem>xguest_t</systemitem> domain have is <application>Firefox</application> connecting to web pages.
</para>
</listitem>
</itemizedlist>
- <para>
- By default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>, preventing them from executing applications (which inherit users' permissions) in directories they have write access to. This helps prevent flawed or malicious applications from modifying files users' own.
- </para>
- <para>
- By default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can execute applications in their home directories and <filename>/tmp/</filename>. Refer to <xref linkend="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications" /> for information about allowing and preventing users from executing applications in their home directories and <filename>/tmp/</filename>.
- </para>
- </section>
+ <!--<section id="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users-Sudoers">
+ <title>Confined Users and Sudoers</title>
+ <para>
+ <remark>WIP version</remark>
+ </para>
+ <para>
+ The <command>sudo</command> command is used to give users administrative access. When trusted users precede an administrative command with <command>sudo</command>, they are prompted for their <emphasis>own</emphasis> password. Then, when they have been authenticated and assuming that the command is permitted, the administrative command is executed as if they were the root user.
+ </para>
+ <para>
+ Users who are allowed to use <command>sudo</command> are listed in the <filename>/etc/sudoers</filename> configuration file. To increase the level of the system security, it is possible to map such users to particular SELinux users. <remark>how?</remark>
+ </para>
+
+
+ <para>
+ The <command>sudo</command> command reads <filename>/etc/sudoers</filename> locally or searches its content using the Lightweight Directory Access Protocol (<acronym>LDAP</acronym>) when the authorization data are centralized. When a system is disconnected from the server, <command>sudo</command> can use the System Security Services Daemon (<systemitem class="daemon">SSSD</systemitem>) to access cached authorization data. This approach brings two main advantages from the SELinux point of view. The rules are cached, therefore client does not need to contact the LDAP server with each request. This behavior leads to less load on the server and to better performance on the client side. In addition, the data can be stored in a Network Information Service (NIS) database or some other databases and access by <command>sudo</command> transparently. <remark>is this somehow connected with <xref linkend="sect-Managing_Confined_Services-Identity_Management-Identity_Management_and_SEL
inux" />?</remark>
+ </para>
+ <para>
+ For more information about <command>sudo</command>, see the appropriate section in the <ulink url="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Lin...">System Administrator's Guide</ulink>.
+ </para>
+ </section> -->
+ </section>
</section>
9 years, 9 months
[securityguide] Updated SELinux Context with new content from RHEL7.
by Bara Ančincová
commit 48293267dd85294f61eb38110deb8f23f49f9741
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Mon Jul 28 10:49:35 2014 +0200
Updated SELinux Context with new content from RHEL7.
en-US/Contexts_and_Attributes.xml | 397 ++++++++++++++++++++-----------------
1 files changed, 212 insertions(+), 185 deletions(-)
---
diff --git a/en-US/Contexts_and_Attributes.xml b/en-US/Contexts_and_Attributes.xml
index b4afae3..101a3f6 100644
--- a/en-US/Contexts_and_Attributes.xml
+++ b/en-US/Contexts_and_Attributes.xml
@@ -3,200 +3,227 @@
]>
<section id="sect-Security-Enhanced_Linux-SELinux_Contexts">
- <title>SELinux Contexts</title>
- <para>
- Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. In &PRODUCT;, SELinux provides a combination of Role-Based Access Control (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS).
- </para>
- <para>
- The following is an example showing SELinux context. SELinux contexts are used on processes, Linux users, and files, on Linux operating systems that run SELinux. Use the <command>ls -Z</command> command to view the SELinux context of files and directories:
- </para>
-
-<screen>$ ls -Z file1
--rw-rw-r--. user1 group1 unconfined_u:object_r:user_home_t:s0 file1
-</screen>
- <para>
- SELinux contexts follow the <emphasis>SELinux user:role:type:level</emphasis> syntax:
- </para>
- <variablelist>
- <varlistentry>
- <term><emphasis>SELinux user</emphasis></term>
- <listitem>
- <para>
- The SELinux user identity is an identity known to the policy that is authorized for a specific set of roles, and for a specific MLS range. Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions placed on SELinux users. The mapped SELinux user identity is used in the SELinux context for processes in that session, in order to define what roles and levels they can enter. Run the <command>semanage login -l</command> command as the Linux root user to view a list of mappings between SELinux and Linux user accounts:
- </para>
-
+ <title>SELinux Contexts</title>
+ <para>
+ Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. In &PRODUCT;, SELinux provides a combination of Role-Based Access Control (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS).
+ </para>
+ <para>
+ The following is an example showing SELinux context. SELinux contexts are used on processes, Linux users, and files, on Linux operating systems that run SELinux. Use the following command to view the SELinux context of files and directories:
+ </para>
<screen>
-# /usr/sbin/semanage login -l
-
-Login Name SELinux User MLS/MCS Range
+<prompt>~]$</prompt> <command>ls -Z file1</command>
+-rwxrw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
+</screen>
+ <para>
+ SELinux contexts follow the <emphasis>SELinux user:role:type:level</emphasis> syntax. The fields are as follows:
+ </para>
+ <variablelist>
+ <varlistentry>
+ <term><emphasis>SELinux user</emphasis></term>
+ <listitem>
+ <para>
+ The SELinux user identity is an identity known to the policy that is authorized for a specific set of roles, and for a specific MLS/MCS range. Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions placed on SELinux users. The mapped SELinux user identity is used in the SELinux context for processes in that session, in order to define what roles and levels they can enter. Run the following command as root to view a list of mappings between SELinux and Linux user accounts (you need to have the <package>policycoreutils-python</package> package installed):
+ </para>
+<screen>
+<prompt>~]#</prompt> <command>semanage login -l</command>
+Login Name SELinux User MLS/MCS Range Service
-__default__ unconfined_u s0-s0:c0.c1023
-root unconfined_u s0-s0:c0.c1023
-system_u system_u s0-s0:c0.c1023
+__default__ unconfined_u s0-s0:c0.c1023 *
+root unconfined_u s0-s0:c0.c1023 *
+system_u system_u s0-s0:c0.c1023 *
</screen>
- <para>
- Output may differ slightly from system to system. The <computeroutput>Login Name</computeroutput> column lists Linux users, and the <computeroutput>SELinux User</computeroutput> column lists which SELinux user the Linux user is mapped to. For processes, the SELinux user limits which roles and levels are accessible. The last column, <computeroutput>MLS/MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) and Multi-Category Security (MCS). Levels are briefly discussed later.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><emphasis>role</emphasis></term>
- <listitem>
- <para>
- Part of SELinux is the Role-Based Access Control (RBAC) security model. The role is an attribute of RBAC. SELinux users are authorized for roles, and roles are authorized for domains. The role serves as an intermediary between domains and SELinux users. The roles that can be entered determine which domains can be entered - ultimately, this controls which object types can be accessed. This helps reduce vulnerability to privilege escalation attacks.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><emphasis>type</emphasis></term>
- <listitem>
- <para>
- The type is an attribute of Type Enforcement. The type defines a domain for processes, and a type for files. SELinux policy rules define how types can access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><emphasis>level</emphasis></term>
- <listitem>
- <para>
- The level is an attribute of MLS and Multi-Category Security (MCS). An MLS range is a pair of levels, written as <emphasis>lowlevel-highlevel</emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the levels are identical (<computeroutput>s0-s0</computeroutput> is the same as <computeroutput>s0</computeroutput>). Each level is a sensitivity-category pair, with categories being optional. If there are categories, the level is written as <emphasis>sensitivity:category-set</emphasis>. If there are no categories, it is written as <emphasis>sensitivity</emphasis>.
- </para>
- <para>
- If the category set is a contiguous series, it can be abbreviated. For example, <computeroutput>c0.c3</computeroutput> is the same as <computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</computeroutput>) to human-readable form (ie. <computeroutput>CompanyConfidential</computeroutput>). Do not edit <filename>setrans.conf</filename> with a text editor: use <command>semanage</command> to make changes. Refer to the <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page for further information. In &PRODUCT;, targeted policy enforces MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</computeroutput>. MCS in &PRODUCT; supports 1024 different categories: <computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is sensitivity <computeroutput>s0
</computeroutput> and authorized for all categories.
- </para>
- <para>
- MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-LaPadula_model">Bell-La Padula Mandatory Access Model</ulink>, and is used in Labeled Security Protection Profile (LSPP) environments. To use MLS restrictions, install the <package>selinux-policy-mls</package> package, and configure MLS to be the default SELinux policy via the <filename>/etc/selinux/config</filename> file. The MLS policy shipped with &PRODUCT; omits many program domains that were not part of the evaluated configuration, and therefore, MLS on a desktop workstation is unusable (no support for the X Window System); however, an MLS policy from the <ulink url="http://oss.tresys.com/projects/refpolicy">upstream SELinux Reference Policy</ulink> can be built that includes all program domains.
- </para>
- </listitem>
- </varlistentry>
- </variablelist>
- <section id="sect-Security-Enhanced_Linux-SELinux_Contexts-Domain_Transitions">
- <title>Domain Transitions</title>
- <para>
- A process in one domain transitions to another domain by executing an application that has the <computeroutput>entrypoint</computeroutput> type for the new domain. The <computeroutput>entrypoint</computeroutput> permission is used in SELinux policy, and controls which applications can be used to enter a domain. The following example demonstrates a domain transition:
- </para>
- <orderedlist>
- <listitem>
- <para>
- A user wants to change their password. To do this, they run the <command>passwd</command> application. The <filename>/usr/bin/passwd</filename> executable is labeled with the <computeroutput>passwd_exec_t</computeroutput> type:
- </para>
-
-<screen>$ ls -Z /usr/bin/passwd
+ <para>
+ Output may differ slightly from system to system:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ The <literal>Login Name</literal> column lists Linux users.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>SELinux User</literal> column lists which SELinux user the Linux user is mapped to. For processes, the SELinux user limits which roles and levels are accessible.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>MLS/MCS Range</literal> column, is the level used by Multi-Level Security (MLS) and Multi-Category Security (MCS).
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <literal>Service</literal> column determines the correct SELinux context, in which the Linux user is supposed to be logged in to the system. By default, the asterisk (<computeroutput>*</computeroutput>) character is used, which stands for any service.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><emphasis>role</emphasis></term>
+ <listitem>
+ <para>
+ Part of SELinux is the Role-Based Access Control (RBAC) security model. The role is an attribute of RBAC. SELinux users are authorized for roles, and roles are authorized for domains. The role serves as an intermediary between domains and SELinux users. The roles that can be entered determine which domains can be entered; ultimately, this controls which object types can be accessed. This helps reduce vulnerability to privilege escalation attacks.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><emphasis>type</emphasis></term>
+ <listitem>
+ <para>
+ The type is an attribute of Type Enforcement. The type defines a domain for processes, and a type for files. SELinux policy rules define how types can access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><emphasis>level</emphasis></term>
+ <listitem>
+ <para>
+ The level is an attribute of MLS and MCS. An MLS range is a pair of levels, written as <emphasis>lowlevel-highlevel</emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the levels are identical (<systemitem>s0-s0</systemitem> is the same as <systemitem>s0</systemitem>). Each level is a sensitivity-category pair, with categories being optional. If there are categories, the level is written as <emphasis>sensitivity:category-set</emphasis>. If there are no categories, it is written as <emphasis>sensitivity</emphasis>.
+ </para>
+ <para>
+ If the category set is a contiguous series, it can be abbreviated. For example, <systemitem>c0.c3</systemitem> is the same as <systemitem>c0,c1,c2,c3</systemitem>. The <filename>/etc/selinux/targeted/setrans.conf</filename> file maps levels (<systemitem>s0:c0</systemitem>) to human-readable form (that is <computeroutput>CompanyConfidential</computeroutput>). In &PRODUCT;, targeted policy enforces MCS, and in MCS, there is just one sensitivity, <systemitem>s0</systemitem>. MCS in &PRODUCT; supports 1024 different categories: <systemitem>c0</systemitem> through to <systemitem>c1023</systemitem>. <systemitem>s0-s0:c0.c1023</systemitem> is sensitivity <systemitem>s0</systemitem> and authorized for all categories.
+ </para>
+ <para>
+ MLS enforces the Bell-La Padula Mandatory Access Model, and is used in Labeled Security Protection Profile (LSPP) environments. To use MLS restrictions, install the <package>selinux-policy-mls</package> package, and configure MLS to be the default SELinux policy. The MLS policy shipped with &PRODUCT; omits many program domains that were not part of the evaluated configuration, and therefore, MLS on a desktop workstation is unusable (no support for the X Window System); however, an MLS policy from the <ulink url="http://oss.tresys.com/projects/refpolicy">upstream SELinux Reference Policy</ulink> can be built that includes all program domains. <!--For more information on MLS configuration, see <xref linkend="mls"/>.-->
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ <section id="sect-Security-Enhanced_Linux-SELinux_Contexts-Domain_Transitions">
+ <title>Domain Transitions</title>
+ <para>
+ A process in one domain transitions to another domain by executing an application that has the <systemitem>entrypoint</systemitem> type for the new domain. The <systemitem>entrypoint</systemitem> permission is used in SELinux policy and controls which applications can be used to enter a domain. The following example demonstrates a domain transition:
+ </para>
+ <procedure id="proc-domain-transition">
+ <title>An Example of a Domain Transition</title>
+ <step>
+ <para>
+ A user wants to change their password. To do this, they run the <systemitem>passwd</systemitem> utility. The <filename>/usr/bin/passwd</filename> executable is labeled with the <systemitem>passwd_exec_t</systemitem> type:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /usr/bin/passwd</command>
-rwsr-xr-x root root system_u:object_r:passwd_exec_t:s0 /usr/bin/passwd
</screen>
- <para>
- The <application>passwd</application> application accesses <filename>/etc/shadow</filename>, which is labeled with the <computeroutput>shadow_t</computeroutput> type:
- </para>
-
-<screen>$ ls -Z /etc/shadow
-----------. root root system_u:object_r:shadow_t:s0 /etc/shadow
+ <para>
+ The <systemitem>passwd</systemitem> utility accesses <filename>/etc/shadow</filename>, which is labeled with the <systemitem>shadow_t</systemitem> type:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>ls -Z /etc/shadow</command>
+-r--------. root root system_u:object_r:shadow_t:s0 /etc/shadow
</screen>
- </listitem>
- <listitem>
- <para>
- An SELinux policy rule states that processes running in the <computeroutput>passwd_t</computeroutput> domain are allowed to read and write to files labeled with the <computeroutput>shadow_t</computeroutput> type. The <computeroutput>shadow_t</computeroutput> type is only applied to files that are required for a password change. This includes <filename>/etc/gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files.
- </para>
- </listitem>
- <listitem>
- <para>
- An SELinux policy rule states that the <computeroutput>passwd_t</computeroutput> domain has <computeroutput>entrypoint</computeroutput> permission to the <computeroutput>passwd_exec_t</computeroutput> type.
- </para>
- </listitem>
- <listitem>
- <para>
- When a user runs the <command>/usr/bin/passwd</command> application, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. With SELinux, since the default action is to deny, and a rule exists that allows (among other things) applications running in the <computeroutput>passwd_t</computeroutput> domain to access files labeled with the <computeroutput>shadow_t</computeroutput> type, the <application>passwd</application> application is allowed to access <filename>/etc/shadow</filename>, and update the user's password.
- </para>
- </listitem>
- </orderedlist>
- <para>
- This example is not exhaustive, and is used as a basic example to explain domain transition. Although there is an actual rule that allows subjects running in the <computeroutput>passwd_t</computeroutput> domain to access objects labeled with the <computeroutput>shadow_t</computeroutput> file type, other SELinux policy rules must be met before the subject can transition to a new domain. In this example, Type Enforcement ensures:
- </para>
- <itemizedlist>
- <listitem>
- <para>
- the <computeroutput>passwd_t</computeroutput> domain can only be entered by executing an application labeled with the <computeroutput>passwd_exec_t</computeroutput> type; can only execute from authorized shared libraries, such as the <computeroutput>lib_t</computeroutput> type; and can not execute any other applications.
- </para>
- </listitem>
- <listitem>
- <para>
- only authorized domains, such as <computeroutput>passwd_t</computeroutput>, can write to files labeled with the <computeroutput>shadow_t</computeroutput> type. Even if other processes are running with superuser privileges, those processes can not write to files labeled with the <computeroutput>shadow_t</computeroutput> type, as they are not running in the <computeroutput>passwd_t</computeroutput> domain.
- </para>
- </listitem>
- <listitem>
- <para>
- only authorized domains can transition to the <computeroutput>passwd_t</computeroutput> domain. For example, the <systemitem class="daemon">sendmail</systemitem> process running in the <computeroutput>sendmail_t</computeroutput> domain does not have a legitimate reason to execute <command>passwd</command>; therefore, it can never transition to the <computeroutput>passwd_t</computeroutput> domain.
- </para>
- </listitem>
- <listitem>
- <para>
- processes running in the <computeroutput>passwd_t</computeroutput> domain can only read and write to authorized types, such as files labeled with the <computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</computeroutput> types. This prevents the <application>passwd</application> application from being tricked into reading or writing arbitrary files.
- </para>
- </listitem>
- </itemizedlist>
- </section>
-
- <section id="sect-Security-Enhanced_Linux-SELinux_Contexts-SELinux_Contexts_for_Processes">
- <title>SELinux Contexts for Processes</title>
- <para>
- Use the <command>ps -eZ</command> command to view the SELinux context for processes. For example:
- </para>
- <orderedlist>
- <listitem>
- <para>
- Open a terminal, such as <menuchoice><guimenu>Applications</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>.
- </para>
- </listitem>
- <listitem>
- <para>
- Run the <command>/usr/bin/passwd</command> command. Do not enter a new password.
- </para>
- </listitem>
- <listitem>
- <para>
- Open a new tab, or another terminal, and run the <command>ps -eZ | grep passwd</command> command. The output is similar to the following:
- </para>
-
-<screen>unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 13212 pts/1 00:00:00 passwd
+ </step>
+ <step>
+ <para>
+ An SELinux policy rule states that processes running in the <systemitem>passwd_t</systemitem> domain are allowed to read and write to files labeled with the <systemitem>shadow_t</systemitem> type. The <systemitem>shadow_t</systemitem> type is only applied to files that are required for a password change. This includes <filename>/etc/gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files.
+ </para>
+ </step>
+ <step>
+ <para>
+ An SELinux policy rule states that the <systemitem>passwd_t</systemitem> domain has <systemitem>entrypoint</systemitem> permission to the <systemitem>passwd_exec_t</systemitem> type.
+ </para>
+ </step>
+ <step>
+ <para>
+ When a user runs the <systemitem>passwd</systemitem> utility, the user's shell process transitions to the <systemitem>passwd_t</systemitem> domain. With SELinux, since the default action is to deny, and a rule exists that allows (among other things) applications running in the <systemitem>passwd_t</systemitem> domain to access files labeled with the <systemitem>shadow_t</systemitem> type, the <systemitem>passwd</systemitem> application is allowed to access <filename>/etc/shadow</filename>, and update the user's password.
+ </para>
+ </step>
+ </procedure>
+ <para>
+ This example is not exhaustive, and is used as a basic example to explain domain transition. Although there is an actual rule that allows subjects running in the <systemitem>passwd_t</systemitem> domain to access objects labeled with the <systemitem>shadow_t</systemitem> file type, other SELinux policy rules must be met before the subject can transition to a new domain. In this example, Type Enforcement ensures:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ The <systemitem>passwd_t</systemitem> domain can only be entered by executing an application labeled with the <systemitem>passwd_exec_t</systemitem> type; can only execute from authorized shared libraries, such as the <systemitem>lib_t</systemitem> type; and cannot execute any other applications.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Only authorized domains, such as <systemitem>passwd_t</systemitem>, can write to files labeled with the <systemitem>shadow_t</systemitem> type. Even if other processes are running with superuser privileges, those processes cannot write to files labeled with the <systemitem>shadow_t</systemitem> type, as they are not running in the <systemitem>passwd_t</systemitem> domain.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Only authorized domains can transition to the <systemitem>passwd_t</systemitem> domain. For example, the <systemitem class="daemon">sendmail</systemitem> process running in the <systemitem>sendmail_t</systemitem> domain does not have a legitimate reason to execute <command>passwd</command>; therefore, it can never transition to the <systemitem>passwd_t</systemitem> domain.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Processes running in the <systemitem>passwd_t</systemitem> domain can only read and write to authorized types, such as files labeled with the <systemitem>etc_t</systemitem> or <systemitem>shadow_t</systemitem> types. This prevents the <systemitem>passwd</systemitem> application from being tricked into reading or writing arbitrary files.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
+ <section id="sect-Security-Enhanced_Linux-SELinux_Contexts-SELinux_Contexts_for_Processes">
+ <title>SELinux Contexts for Processes</title>
+ <para>
+ Use the <command>ps -eZ</command> command to view the SELinux context for processes. For example:
+ </para>
+ <procedure id="proc-viewing-selinuc-context-for-passwd">
+ <title>View the SELinux Context for the <systemitem>passwd</systemitem> Utility</title>
+ <step>
+ <para>
+ Open a terminal, such as <menuchoice><guimenu>Applications</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>.
+ </para>
+ </step>
+ <step>
+ <para>
+ Run the <systemitem>passwd</systemitem> utility. Do not enter a new password:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>passwd</command>
+Changing password for user <replaceable>user_name</replaceable>.
+Changing password for <replaceable>user_name</replaceable>.
+(current) UNIX password:
+</screen>
+ </step>
+ <step>
+ <para>
+ Open a new tab, or another terminal, and run the following command. The output is similar to the following:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>ps -eZ | grep passwd</command>
+unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 13212 pts/1 00:00:00 passwd
</screen>
- </listitem>
- <listitem>
- <para>
- In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the <application>passwd</application> application.
- </para>
- </listitem>
- </orderedlist>
- <para>
- In this example, when the <filename>/usr/bin/passwd</filename> application (labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is executed, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. Remember: the type defines a domain for processes, and a type for files.
- </para>
- <para>
- Use the <command>ps -eZ</command> command to view the SELinux contexts for running processes. The following is a limited example of the output, and may differ on your system:
- </para>
-
+ </step>
+ <step>
+ <para>
+ In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the <systemitem>passwd</systemitem> utility.
+ </para>
+ </step>
+ </procedure>
+ <para>
+ In this example, when the <systemitem>passwd</systemitem> utility (labeled with the <systemitem>passwd_exec_t</systemitem> type) is executed, the user's shell process transitions to the <systemitem>passwd_t</systemitem> domain. Remember that the type defines a domain for processes, and a type for files.
+ </para>
+ <para>
+ To view the SELinux contexts for all running processes, run the <systemitem>ps</systemitem> utility again. Note that below is a truncated example of the output, and may differ on your system:
+ </para>
<screen>
-system_u:system_r:dhcpc_t:s0 1869 ? 00:00:00 dhclient
-system_u:system_r:sshd_t:s0-s0:c0.c1023 1882 ? 00:00:00 sshd
-system_u:system_r:gpm_t:s0 1964 ? 00:00:00 gpm
-system_u:system_r:crond_t:s0-s0:c0.c1023 1973 ? 00:00:00 crond
-system_u:system_r:kerneloops_t:s0 1983 ? 00:00:05 kerneloops
-system_u:system_r:crond_t:s0-s0:c0.c1023 1991 ? 00:00:00 atd
+<prompt>]$</prompt> <command>ps -eZ</command>
+system_u:system_r:dhcpc_t:s0 1869 ? 00:00:00 dhclient
+system_u:system_r:sshd_t:s0-s0:c0.c1023 1882 ? 00:00:00 sshd
+system_u:system_r:gpm_t:s0 1964 ? 00:00:00 gpm
+system_u:system_r:crond_t:s0-s0:c0.c1023 1973 ? 00:00:00 crond
+system_u:system_r:kerneloops_t:s0 1983 ? 00:00:05 kerneloops
+system_u:system_r:crond_t:s0-s0:c0.c1023 1991 ? 00:00:00 atd
</screen>
- <para>
- The <computeroutput>system_r</computeroutput> role is used for system processes, such as daemons. Type Enforcement then separates each domain.
- </para>
- </section>
-
- <section id="sect-Security-Enhanced_Linux-SELinux_Contexts-SELinux_Contexts_for_Users">
- <title>SELinux Contexts for Users</title>
- <para>
- Use the <command>id -Z</command> command to view the SELinux context associated with your Linux user:
- </para>
-
-<screen>unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
+ <para>
+ The <systemitem>system_r</systemitem> role is used for system processes, such as daemons. Type Enforcement then separates each domain.
+ </para>
+ </section>
+ <section id="sect-Security-Enhanced_Linux-SELinux_Contexts-SELinux_Contexts_for_Users">
+ <title>SELinux Contexts for Users</title>
+ <para>
+ Use the following command to view the SELinux context associated with your Linux user:
+ </para>
+<screen>
+<prompt>~]$</prompt> <command>id -Z</command>
+unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
</screen>
- <para>
- In &PRODUCT;, Linux users run unconfined by default. This SELinux context shows that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user, running as the <computeroutput>unconfined_r</computeroutput> role, and is running in the <computeroutput>unconfined_t</computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS range, which in this case, is the same as just <computeroutput>s0</computeroutput>. The categories the user has access to is defined by <computeroutput>c0.c1023</computeroutput>, which is all categories (<computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>).
- </para>
- </section>
-
+ <para>
+ In &PRODUCT;, Linux users run unconfined by default. This SELinux context shows that the Linux user is mapped to the SELinux <systemitem>unconfined_u</systemitem> user, running as the <systemitem>unconfined_r</systemitem> role, and is running in the <systemitem>unconfined_t</systemitem> domain. <systemitem>s0-s0</systemitem> is an MLS range, which in this case, is the same as just <systemitem>s0</systemitem>. The categories the user has access to is defined by <systemitem>c0.c1023</systemitem>, which is all categories (<systemitem>c0</systemitem> through to <systemitem>c1023</systemitem>).
+ </para>
+ </section>
</section>
9 years, 9 months
[securityguide] Updated SELinux intro with new content from RHEL7.
by Bara Ančincová
commit 981e0993f401dd39c17fdc9d544879e2f4da0487
Author: Barbora Ancincova <bancinco(a)redhat.com>
Date: Mon Jul 28 10:30:22 2014 +0200
Updated SELinux intro with new content from RHEL7.
en-US/Introduction.xml | 117 ++++++++++++++++++++++--------------------------
1 files changed, 53 insertions(+), 64 deletions(-)
---
diff --git a/en-US/Introduction.xml b/en-US/Introduction.xml
index ec4c2cd..643e7d1 100644
--- a/en-US/Introduction.xml
+++ b/en-US/Introduction.xml
@@ -5,27 +5,27 @@
<section id="sect-Security-Enhanced_Linux-Introduction">
<title>Introduction</title>
<para>
- Security-Enhanced Linux (SELinux) is an implementation of a <firstterm>mandatory access control</firstterm> mechanism in the Linux kernel, checking for allowed operations after standard <firstterm>discretionary access controls</firstterm> are checked. It was created by the National Security Agency and can enforce rules on files and processes in a Linux system, and on their actions, based on defined policy.
+ Security-Enhanced Linux (SELinux) is an implementation of a <firstterm>mandatory access control</firstterm> mechanism in the Linux kernel, checking for allowed operations after standard <firstterm>discretionary access controls</firstterm> are checked. It was created by the National Security Agency and can enforce rules on files and processes in a Linux system, and on their actions, based on defined policies.
</para>
<para>
When using SELinux, files, including directories and devices, are referred to as objects. Processes, such as a user running a command or the <trademark class="registered">Mozilla</trademark><trademark class="registered"> Firefox</trademark> application, are referred to as subjects. Most operating systems use a Discretionary Access Control (DAC) system that controls how subjects interact with objects, and how subjects interact with each other. On operating systems using DAC, users control the permissions of files (objects) that they own. For example, on <trademark class="registered">Linux</trademark> operating systems, users could make their home directories world-readable, giving users and processes (subjects) access to potentially sensitive information, with no further protection over this unwanted action.
</para>
<para>
- Relying on DAC mechanisms alone is fundamentally inadequate for strong system security. DAC access decisions are only based on user identity and ownership, ignoring other security-relevant information such as the role of the user, the function and trustworthiness of the program, and the sensitivity and integrity of the data. Each user has complete discretion over their files, making it impossible to enforce a system-wide security policy. Furthermore, every program run by a user inherits all of the permissions granted to the user and is free to change access to the user's files, so no protection is provided against malicious software. Many system services and privileged programs must run with coarse-grained privileges that far exceed their requirements, so that a flaw in any one of these programs could be exploited to obtain further system access.<footnote>
+ Relying on DAC mechanisms alone is fundamentally inadequate for strong system security. DAC access decisions are only based on user identity and ownership, ignoring other security-relevant information such as the role of the user, the function and trustworthiness of the program, and the sensitivity and integrity of the data. Each user typically has complete discretion over their files, making it difficult to enforce a system-wide security policy. Furthermore, every program run by a user inherits all of the permissions granted to the user and is free to change access to the user's files, so minimal protection is provided against malicious software. Many system services and privileged programs run with coarse-grained privileges that far exceed their requirements, so that a flaw in any one of these programs could be exploited to obtain further system access.<footnote>
<para>
"Integrating Flexible Support for Security Policies into the Linux Operating System", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/freenix01/index.shtml">original paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister.
</para>
</footnote>
</para>
<para>
- The following is an example of permissions used on Linux operating systems that do not run Security-Enhanced Linux (SELinux). The permissions and output in these examples may differ from your system. Use the <command>ls -l</command> command to view file permissions:
+ The following is an example of permissions used on Linux operating systems that do not run Security-Enhanced Linux (SELinux). The permissions and output in these examples may differ slightly from your system. Use the following command to view file permissions:
</para>
-<screen>$ ls -l file1
--rw-rw-r--. 1 user1 group1 0 May 11 10:46 file1
+<screen><prompt>~]$</prompt> <command>ls -l <replaceable>file1</replaceable></command>
+-rwxrw-r-- 1 user1 group1 0 2009-08-30 11:03 file1
</screen>
<para>
- The first three permission bits, <computeroutput>rw</computeroutput>, control the access the Linux <computeroutput>user1</computeroutput> user (in this case, the owner) has to <filename>file1</filename>. The next three permission bits, <computeroutput>rw-</computeroutput>, control the access the Linux <computeroutput>group1</computeroutput> group has to <filename>file1</filename>. The last three permission bits, <computeroutput>r--</computeroutput>, control the access everyone else has to <filename>file1</filename>, which includes all users and processes.
+ In this example, the first three permission bits, <computeroutput>rwx</computeroutput>, control the access the Linux <literal>user1</literal> user (in this case, the owner) has to <filename>file1</filename>. The next three permission bits, <computeroutput>rw-</computeroutput>, control the access the Linux <computeroutput>group1</computeroutput> group has to <filename>file1</filename>. The last three permission bits, <computeroutput>r--</computeroutput>, control the access everyone else has to <filename>file1</filename>, which includes all users and processes.
</para>
<para>
Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the Linux kernel, and is enabled by default in &PRODUCT;. A general purpose MAC architecture needs the ability to enforce an administratively-set security policy over all processes and files in the system, basing decisions on labels containing a variety of security-relevant information. When properly implemented, it enables a system to adequately defend itself and offers critical support for application security by protecting against the tampering with, and bypassing of, secured applications. MAC provides strong separation of applications that permits the safe execution of untrustworthy applications. Its ability to limit the privileges associated with executing processes limits the scope of potential damage that can result from the exploitation of vulnerabilities in applications and system services. MAC enables information to be protected from legitimate users with limited authorization as well as fro
m authorized users who have unwittingly executed malicious applications.<footnote>
@@ -35,21 +35,24 @@
</footnote>
</para>
<para>
- The following is an example of the labels containing security-relevant information that are used on processes, Linux users, and files, on Linux operating systems that run SELinux. This information is called the SELinux <emphasis>context</emphasis>, and is viewed using the <command>ls -Z</command> command:
+ The following is an example of the labels containing security-relevant information that are used on processes, Linux users, and files, on Linux operating systems that run SELinux. This information is called the SELinux <emphasis>context</emphasis>, and is viewed using the following command:
</para>
-<screen>$ ls -Z file1
--rw-rw-r--. user1 group1 unconfined_u:object_r:user_home_t:s0 file1
+<screen><prompt>~]</prompt>$ <command>ls -Z file1</command>
+-rwxrw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1
</screen>
<para>
- In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. With DAC, access is controlled based only on Linux user and group IDs. It is important to remember that SELinux policy rules are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are not used if DAC rules deny access first.
+ In this example, SELinux provides a user (<systemitem>unconfined_u</systemitem>), a role (<systemitem>object_r</systemitem>), a type (<systemitem>user_home_t</systemitem>), and a level (<systemitem>s0</systemitem>). This information is used to make access control decisions. With DAC, access is controlled based only on Linux user and group IDs. It is important to remember that SELinux policy rules are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are not used if DAC rules deny access first.
</para>
- <formalpara id="form-Security-Enhanced_Linux-Introduction-Linux_and_SELinux_Users">
- <title>Linux and SELinux Users</title>
- <para>
- On Linux operating systems that run SELinux, there are Linux users as well as SELinux users. SELinux users are part of SELinux policy. Linux users are mapped to SELinux users. To avoid confusion, this guide uses "Linux user" and "SELinux user" to differentiate between the two.
- </para>
- </formalpara>
+ <note>
+ <title>Linux and SELinux Users</title>
+ <para>
+ On Linux operating systems that run SELinux, there are Linux users as well as SELinux users. SELinux users
+ are part of SELinux policy. Linux users are mapped to SELinux users. To avoid confusion, this guide uses
+ <emphasis>Linux user</emphasis> and <emphasis>SELinux user</emphasis> to differentiate between the two.
+ </para>
+ </note>
+
<section id="sect-Security-Enhanced_Linux-Introduction-Benefits_of_running_SELinux">
<title>Benefits of running SELinux</title>
<itemizedlist>
@@ -60,7 +63,7 @@
</listitem>
<listitem>
<para>
- Fine-grained access control. Stepping beyond traditional <trademark class="registered">UNIX</trademark> permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information, such as an SELinux user, role, type, and, optionally, a level.
+ Fine-grained access control. Stepping beyond traditional <trademark class="registered">UNIX</trademark> permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information, such as an SELinux user, role, type, and, optionally, a level.
</para>
</listitem>
<listitem>
@@ -70,12 +73,7 @@
</listitem>
<listitem>
<para>
- Reduced vulnerability to privilege escalation attacks. One example: since processes run in domains, and are therefore separated from each other, and because SELinux policy rules define how processes access files and other processes, if a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For example, if the Apache HTTP Server is compromised, an attacker can not use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access.
- </para>
- </listitem>
- <listitem>
- <para>
- Confined services. SELinux ships with the ability to confine services and daemons so that they are more predictable and are only allowed access that is required for their normal operation.
+ Reduced vulnerability to privilege escalation attacks. Processes run in domains, and are therefore separated from each other. SELinux policy rules define how processes access files and other processes. If a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For example, if the Apache HTTP Server is compromised, an attacker cannot use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access.
</para>
</listitem>
<listitem>
@@ -85,17 +83,17 @@
</listitem>
</itemizedlist>
<para>
- SELinux is not:
+ However, SELinux is not:
</para>
<itemizedlist>
<listitem>
<para>
- antivirus software.
+ antivirus software,
</para>
</listitem>
<listitem>
<para>
- a replacement for passwords, firewalls, or other security systems.
+ a replacement for passwords, firewalls, or other security systems,
</para>
</listitem>
<listitem>
@@ -117,55 +115,52 @@
<itemizedlist>
<listitem>
<para>
- The default action is deny. If a specific SELinux policy rule does not exist to allow access, such as for a process opening a file, access is denied.
+ The default action is deny. If an SELinux policy rule does not exist to allow access, such as for a process opening a file, access is denied.
</para>
</listitem>
<listitem>
<para>
- SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as <command>sudo</command> and <command>su</command>, as well as preventing them from executing files and applications in their home directory - if configured, this prevents users from executing malicious files from their home directories.
+ SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux <literal>user_u</literal> user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as <command>sudo</command> and <command>su</command>, as well as preventing them from executing files and applications in their home directory. If configured, this prevents users from executing malicious files from their home directories.
</para>
</listitem>
<listitem>
<para>
- Process separation is used. Processes run in their own domains, preventing processes from accessing files used by other processes, as well as preventing processes from accessing other processes. For example, when running SELinux, unless otherwise configured, an attacker can not compromise a Samba server, and then use that Samba server as an attack vector to read and write to files used by other processes, such as databases used by <trademark class="registered">MySQL</trademark>.
+ Process separation is used. Processes run in their own domains, preventing processes from accessing files used by other processes, as well as preventing processes from accessing other processes. For example, when running SELinux, unless otherwise configured, an attacker cannot compromise a Samba server, and then use that Samba server as an attack vector to read and write to files used by other processes, such as databases used by MariaDB.
</para>
</listitem>
<listitem>
<para>
- SELinux helps limit the damage made by configuration mistakes. <ulink url="http://en.wikipedia.org/wiki/Domain_Name_System">Domain Name System (DNS)</ulink> servers often replicate information between each other in what is known as a zone transfer. Attackers can use zone transfers to update DNS servers with false information. When running the <ulink url="https://www.isc.org/software/bind">Berkeley Internet Name Daemon (BIND)</ulink> as a DNS server in &PRODUCT;, even if an administrator forgets to limit which servers can perform a zone transfer, the default SELinux policy prevents zone files <footnote>
+ SELinux helps limit the damage made by configuration mistakes. Domain Name System (DNS) servers often replicate information between each other in what is known as a zone transfer. Attackers can use zone transfers to update DNS servers with false information. When running the Berkeley Internet Name Domain (BIND) as a DNS server in &PRODUCT;, even if an administrator forgets to limit which servers can perform a zone transfer, the default SELinux policy prevents zone files <footnote>
<para>
- Text files that include information, such as hostname to IP address mappings, that are used by DNS servers.
+ Text files that include information, such as host name to IP address mappings, that are used by DNS servers.
</para>
</footnote> from being updated via zone transfers, by the BIND <systemitem class="daemon">named</systemitem> daemon itself, and by other processes.
</para>
</listitem>
- <listitem>
+ <!--<listitem>
<para>
- Refer to the <ulink url="http://www.redhatmagazine.com/"><trademark class="registered">Red Hat</trademark> Magazine</ulink> article, <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-h...">Risk report: Three years of Red Hat Enterprise Linux 4</ulink><footnote>
+ Refer to the <ulink url="http://magazine.redhat.com/">Red Hat Magazine</ulink> article, <ulink url="http://magazine.redhat.com/2008/02/26/risk-report-three-years-of-red-hat-...">Risk report: Three years of Red Hat Enterprise Linux 4</ulink><footnote>
<para>
- Cox, Mark. "Risk report: Three years of Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August 2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-h..."></ulink>.
+ Cox, Mark. "Risk report: Three years of Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August 2009: <ulink url="http://magazine.redhat.com/2008/02/26/risk-report-three-years-of-red-hat-..."></ulink>.
</para>
- </footnote>, for exploits that were restricted due to the default SELinux targeted policy in <trademark class="registered">Red Hat</trademark> Enterprise <trademark class="registered">Linux</trademark> 4.
+ </footnote>, for exploits that were restricted due to the default SELinux targeted policy in Red Hat Enterprise Linux 4.
</para>
- </listitem>
+ </listitem>-->
<listitem>
<para>
- Refer to the <ulink url="http://www.linuxworld.com">LinuxWorld.com</ulink> article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1">A seatbelt for server software: SELinux blocks real-world exploits</ulink><footnote>
+ Refer to the <ulink url="http://www.networkworld.com">NetworkWorld.com</ulink> article, <ulink url="http://www.networkworld.com/news/2008/022408-selinux.html">A seatbelt for server software: SELinux blocks real-world exploits</ulink><footnote>
<para>
- Marti, Don. "A seatbelt for server software: SELinux blocks real-world exploits". Published 24 February 2008. Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1"></ulink>.
+ Marti, Don. "A seatbelt for server software: SELinux blocks real-world exploits". Published 24 February 2008. Accessed 27 August 2009: <ulink url="http://www.networkworld.com/news/2008/022408-selinux.html"></ulink>.
</para>
</footnote>, for background information about SELinux, and information about various exploits that SELinux has prevented.
</para>
</listitem>
- <listitem>
+ <!--<listitem>
<para>
Refer to James Morris's <ulink url="http://james-morris.livejournal.com/25421.html">SELinux mitigates remote root vulnerability in OpenPegasus</ulink> blog post for information about an exploit in <ulink url="http://www.openpegasus.org/">OpenPegasus</ulink> that was mitigated by SELinux as shipped with Red Hat Enterprise Linux 4 and 5.
</para>
- </listitem>
+ </listitem>-->
</itemizedlist>
- <para>
- The <ulink url="http://www.tresys.com/">Tresys Technology</ulink> website has an <ulink url="http://www.tresys.com/innovation.php">SELinux Mitigation News</ulink> section (on the right-hand side), that lists recent exploits that have been mitigated or prevented by SELinux.
- </para>
</section>
<section id="sect-Security-Enhanced_Linux-Introduction-SELinux_Architecture">
@@ -174,43 +169,37 @@
SELinux is a Linux security module that is built into the Linux kernel. SELinux is driven by loadable policy rules. When security-relevant access is taking place, such as when a process attempts to open a file, the operation is intercepted in the kernel by SELinux. If an SELinux policy rule allows the operation, it continues, otherwise, the operation is blocked and the process receives an error.
</para>
<para>
- SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Caching decisions decreases how often SELinux policy rules need to be checked, which increases performance. Remember that SELinux policy rules have no effect if DAC rules deny access first.
+ SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). When using these cached decisions, SELinux policy rules need to be checked less, which increases performance. Remember that SELinux policy rules have no effect if DAC rules deny access first.
</para>
- </section>
-
- <section id="sect-Security-Enhanced_Linux-Introduction-SELinux_on_Other_Operating_Systems">
- <title>SELinux on Other Operating Systems</title>
- <para>
- Refer to the following for information about running SELinux on operating systems:
+ </section>
+ <section id="sect-Security-Enhanced_Linux-Introduction-SELinux_Modes">
+ <title>SELinux Modes</title>
+ <para>
+ SELinux has three modes:
</para>
<itemizedlist>
<listitem>
<para>
- Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml"></ulink>.
- </para>
- </listitem>
- <listitem>
- <para>
- Debian: <ulink url="http://wiki.debian.org/SELinux"></ulink>.
- </para>
- </listitem>
- <listitem>
- <para>
- Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux"></ulink> and <ulink url="https://help.ubuntu.com/community/SELinux"></ulink>.
+ Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules.
</para>
</listitem>
<listitem>
<para>
- Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploy...">Red Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/">Red Hat Enterprise Linux 4 SELinux Guide</ulink>.
+ Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode.
</para>
</listitem>
<listitem>
<para>
- Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux"></ulink> and the <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/">Fedora Core 5 SELinux FAQ</ulink>.
+ Disabled: SELinux is disabled. Only DAC rules are used.
</para>
</listitem>
</itemizedlist>
+ <para>
+ Use the <command>setenforce</command> utility to change between enforcing and permissive mode. Changes made with <command>setenforce</command> do not persist across reboots. To change to enforcing mode, as the Linux root user, run the <command>setenforce 1</command> command. To change to permissive mode, run the <command>setenforce 0</command> command. Use the <command>getenforce</command> utility to view the current SELinux mode.
+ </para>
+ <para>
+ Persistent mode changes are covered in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />.
+ </para>
</section>
-
</section>
9 years, 9 months
[documentation-guide] Fix lang. and typos.
by rkratky
commit 88125f09a56fe9232e9e8a629e52c7013caadc75
Author: Robert Krátký <rkratky(a)redhat.com>
Date: Fri Aug 8 16:45:19 2014 +0200
Fix lang. and typos.
en-US/style.xml | 32 ++++++++++++++++----------------
1 files changed, 16 insertions(+), 16 deletions(-)
---
diff --git a/en-US/style.xml b/en-US/style.xml
index bff0b4a..cda5820 100644
--- a/en-US/style.xml
+++ b/en-US/style.xml
@@ -5,10 +5,10 @@
]>
<appendix id="chap-documentation_guide-style">
<title>Style Guide</title>
- <para>Writing high-quality documents that are easily understood by multiple readers can be a difficult challenge. There are many different techniques that can be used in writing, and there are many different ways of writing the same information. In order to provide consistent, readable documentation, certain standards must be established. There are many different writing style guides that serve different purposes and audiences. Good style is something learned and practiced.</para>
- <para>The Fedora Documentation Project is tasked with producing friendly, easy-to-read documentation for a worldwide audience. This means writing clean, clear documents with great attention to differences in cultures and languages. The Fedora Documentation Style Guide outlines specific rules and recommendations for documentation contributors. The style guidelines standardize documentation of both technical and non-technical information, to increase readability and comprehension.</para>
- <para>The writers producing Fedora documentation come from a variety of backgrounds, each with different skill sets. Through use of the Fedora Documentation Style Guide, contributors produce and collaborate on documentation with consistent results. This style guide may vary from each contributor's familiar writing requirements. Practicing this guide will eventually become a comfortable standard with benefits outside of Fedora documentation. This style guide will demonstrate the rules and guidelines it sets forth.</para>
- <para>The Fedora Documentation Style Guide borrows many ideas from the Associated Press (AP) Stylebook and The Chicago Manual of Style. Any differences from those guides are intended to enhance the value of documents for international readers, and accommodate the technical nature of Fedora documentation. Particular care is made to adopt international standards for common notations to avoid confusion across cultural lines.</para>
+ <para>Writing high-quality documents that are easily understood by multiple readers can be a difficult challenge. There are many different techniques that can be used in writing, and there are many different ways of writing the same information. In order to provide consistent, readable documentation, certain standards must be established. There are many different writing-style guides that serve different purposes and audiences. Good style is something learned and practiced.</para>
+ <para>The Fedora Documentation Project is tasked with producing friendly, easy-to-read documentation for a worldwide audience. This means writing clean, clear documents with great attention to differences in cultures and languages. The Fedora Documentation Style Guide outlines specific rules and recommendations for documentation contributors. The style guidelines standardize documentation of both technical and non-technical information to increase readability and comprehension.</para>
+ <para>The writers producing Fedora documentation come from a variety of backgrounds, each with different skill sets. Through the use of the <citetitle pubwork="book">Fedora Documentation Style Guide</citetitle>, contributors produce and collaborate on documentation with consistent results. This style guide may vary from each contributor's familiar writing requirements. Practicing this guide will eventually become a comfortable standard with benefits outside of Fedora documentation. This style guide will demonstrate the rules and guidelines it sets forth.</para>
+ <para>The <citetitle pubwork="book">Fedora Documentation Style Guide</citetitle> borrows many ideas from the Associated Press (AP) Stylebook and The Chicago Manual of Style. Any differences from those guides are intended to enhance the value of documents for international readers, and accommodate the technical nature of Fedora documentation. Particular care is made to adopt international standards for common notations to avoid confusion across cultural lines.</para>
<section id="sect-documentation_guide-style-general_guidelines">
<title>General Guidelines</title>
@@ -22,7 +22,7 @@
<title>Voice</title>
<para>Instructions and rules use an <emphasis>active voice</emphasis>, presenting confidence to the reader without sounding demanding. An active voice provides clear direction. It shows the reader what to do and gives expected results. Active voice leaves the reader with the impression an author stands behind the written work.</para>
- <warning><title>Avoid Passive Voice Unless Necessary</title><para>Passive voice is completely correct grammatically, but it is a barrier to reader comprehension. The passive voice flips conventional sentence structure around. It moves the verb and direct object forward to the first half of a sentence, and places the main subject in the second half of a sentence. Often a simple restructuring of the sentence makes it active. Long passive sentences frequently take multiple reads before a reader grasps the full meaning.</para></warning>
+ <warning><para>Passive voice is completely correct grammatically, but it is a barrier to reader comprehension. The passive voice flips conventional sentence structure around. It moves the verb and direct object forward to the first half of a sentence and places the main subject in the second half of a sentence. Often a simple restructuring of the sentence makes it active. Long passive sentences frequently take multiple reads before a reader grasps the full meaning.</para></warning>
<para>
<simplelist>
@@ -37,7 +37,7 @@
</section>
<section id="sect-documentation_guide-style-general_guidelines-composition-emphasis">
<title>Emphasis</title>
- <para>Emphasis is most effective when used sparingly. Use methods of emphasis such as boldface, underlining, or oblique text to draw attention to a new term. Use admonitions to set off notable material. Another acceptable way to emphasize a point is with varying sentence formation or word choice. The best documentation writers plan ahead for emphasis, applying it with careful consistency throughout the document.</para>
+ <para>Emphasis is most effective when used sparingly. Use methods of emphasis, such as boldface, underlining, or oblique text, to draw attention to a new term. Use admonitions to set off notable material. Another acceptable way to emphasize a point is with varying sentence formation or word choice. The best documentation writers plan ahead for emphasis, applying it with careful consistency throughout the document.</para>
</section>
<section id="sect-documentation_guide-style-general_guidelines-composition-accuracy_and_precision">
<title>Accuracy and Precision</title>
@@ -57,7 +57,7 @@
</section>
<section id="sect-documentation_guide-style-general_guidelines-Usage-Pronouns">
<title>Pronouns</title>
- <para>Pronouns are words language uses to replace specific noun phrases. Good writers must strike a balance between over-repeating a noun phrase, and using pronouns to stand in for nouns. A general rule to preserve clarity is to never repeat noun substitution with a pronoun in two consecutive sentences. Readers of technical documents need constant reminders on the exact subject the author is writing about. Prevalent use of pronouns cause readers to guess the subject a sentence is referencing. These assumptions reduce the effectiveness of documentation.</para>
+ <para>Pronouns are words languages use to replace specific noun phrases. Good writers must strike a balance between over-repeating a noun phrase and using pronouns to stand in for nouns. A general rule to preserve clarity is to never repeat noun substitution with a pronoun in two consecutive sentences. Readers of technical documents need constant reminders on the exact subject the author is writing about. Prevalent use of pronouns causes readers to guess the subject a sentence is referencing. These assumptions reduce the effectiveness of documentation.</para>
<para>Avoid most personal pronouns in documentation, including the following:
<simplelist>
<member>Subjective personal pronouns ("I," "he," "she," "it," "we,")</member>
@@ -72,8 +72,8 @@
<member>Resist overuse of "you", "your", and "one/one's"</member>
</simplelist>
</para>
- <para>Occasionally situations require the second personal pronoun "you," and its attendant forms for clarity. Maintaining an active voice is paramount over avoiding the second personal pronouns. "You" and "your" are appropriate words to indicate action or possession on the part of the reader.</para>
- <para>Indefinite pronouns such as "this" or "that" without an antecedent make it tough for a reader to follow an author's meaning. Favor writing an exact noun phrase whenever possible over the vague words "this," "these," "those," and "that."</para>
+ <para>Occasionally, situations require the second personal pronoun "you" and its attendant forms for clarity. Maintaining an active voice is paramount over avoiding the second personal pronouns. "You" and "your" are appropriate words to indicate action or possession on the part of the reader.</para>
+ <para>Indefinite pronouns, such as "this" or "that", without an antecedent make it tough for a reader to follow an author's meaning. Favor writing an exact noun phrase whenever possible over the vague words "this", "these", "those", and "that."</para>
<para>
<simplelist>
<member>INCORRECT: Edit your yum configuration files to use geographically close mirrors. This allows you to update your system faster.</member>
@@ -93,7 +93,7 @@
<para>Keep sentences as short as possible. Cutting unnecessary words is vital to strengthen meaning. There are a number of common traps technical writers fall into resulting in lengthy sentences.</para>
<section>
<title>Indirect Discourse</title>
- <para>Indirect discourse refers to the use of "that" to attribute a statement, fact, or feeling in a sentence without the use of quotation marks. In regular writing, it weakens statements of fact. Documentation writers can improve the impact of sentences by removing "that" and "which."</para>
+ <para>Indirect discourse refers to the use of "that" to attribute a statement, fact, or feeling in a sentence without the use of quotation marks. In regular writing, it weakens statements of fact. Documentation writers can improve the impact of sentences by removing "that" and "which".</para>
<simplelist>
<member>INCORRECT: Fedora is an open source operating system that is upstream for many other open source projects.</member>
<member>CORRECT: Fedora is an upstream open source operating system for many other open source projects.</member>
@@ -107,12 +107,12 @@
<member>CORRECT: If an email client will not send or receive messages, check under the File Menu and verify "Work Offline" mode is unselected.</member>
</simplelist>
</para>
- <para>Many words we use in everyday conversation reduce impact in printed materials because they "leave a way out." These are words preceding verbs and nouns to minimize the sentence's influence. This is not an exhaustive list, but mindful documentation writers will reduce using these words and those of a similar nature.</para>
- <warning><title>Avoid Reducing Impact With Unnecessary Words</title><para>The following words minimize the impact of the verb or noun clause within a sentence. Other words also fit into this category, but this short list is aimed at helping documentation writers identify words of this nature and eliminate them from their writing: should, could, may, might, perhaps, some, many, most, numerous, few, somewhat, whatever, possibly, can, occasionally, and frequently.</para></warning>
+ <para>Many words we use in everyday conversation reduce impact in printed materials because they "leave a way out". These are words preceding verbs and nouns to minimize the sentence's influence. This is not an exhaustive list, but mindful documentation writers will reduce using these words and those of a similar nature.</para>
+ <warning><para>The following words minimize the impact of the verb or noun clause within a sentence. Other words also fit into this category, but this short list is aimed at helping documentation writers identify words of this nature and eliminate them from their writing: should, could, may, might, perhaps, some, many, most, numerous, few, somewhat, whatever, possibly, can, occasionally, and frequently.</para></warning>
</section>
<section>
<title>Sentence Variation</title>
- <para>For the strongest impact, keep the first and last sentences of a paragraph as short as possible. Varying sentence length within a paragraph and through the entire document keeps a reader's attention. A short and simple fact is easy to grasp and use to analyze the next sentence's topic. There is nothing wrong with using longer sentences to explain complex ideas and concepts. Try to use a simple synopsis sentence at the end of each paragraph to give readers a reprieve and recap of any important information. A short final sentence stays with the reader to the next section.</para>
+ <para>For the strongest impact, keep the first and last sentences of a paragraph as short as possible. Varying sentence length within a paragraph and through the entire document keeps a reader's attention. A short and simple fact is easy to grasp and use to analyze the next sentence's topic. There is nothing wrong with using longer sentences to explain complex ideas and concepts. Try to use a simple synopsis sentence at the end of each paragraph to give readers a reprieve and recap any important information. A short final sentence stays with the reader to the next section.</para>
</section>
</section>
<section id="sect-documentation_guide-style-general_guidelines-Usage-capitalization">
@@ -123,7 +123,7 @@
<member>CORRECT: The <code>smolt</code> package provides hardware profiling.</member>
</simplelist>
</para>
- <para>In headings, always capitalize the first word regardless of the type of speech. All subsequent words are also capitalized other than articles ("a," "an," or "the"), short prepositions ("in," "of," "for," "with," "at," "on"), or conjunctions ("and," "but," "or").</para>
+ <para>In headings, always capitalize the first word regardless of the type of speech. All subsequent words are also capitalized other than articles ("a", "an", or "the"), short prepositions ("in", "of", "for", "with", "at", "on"), or conjunctions ("and", "but", "or").</para>
<para>Examples:
<simplelist>
<member>Avoid Using Contractions in Technical Writing</member>
@@ -139,8 +139,8 @@
<para>Minimize the following punctuation marks in documentation:
<simplelist>
<member><emphasis>Parentheses or em dashes</emphasis> - To compensate, rearrange the sentence, or break it into two complete thoughts.</member>
- <member><emphasis>Semicolons</emphasis> - Good to use only if two thoughts are related, must be joined for clarity, and removes the need for a conjunction.</member>
- <member><emphasis>Colon</emphasis> - If there are more than three items, use a bulleted list for easy comprehension.</member>
+ <member><emphasis>Semicolons</emphasis> - Good to use only if two thoughts are related, must be joined for clarity, and remove the need for a conjunction.</member>
+ <member><emphasis>Colon</emphasis> - If there are more than three items, use a bullet list for easy comprehension.</member>
<member><emphasis>Ellipsis</emphasis> - Do not use for stylistic emphasis... only to denote an indefinite continuation of content in an example.</member>
<member><emphasis>Exclamation points</emphasis> - In technical writing this is accepted for use only as a most dire "warning" admonition, not for emphasis.</member>
<member><emphasis>Ampersands</emphasis> - The word "and" is to be written out, and this mark only reserved if it is part of a computer command.</member>
9 years, 9 months
[documentation-guide] Fix lang., typos., and mark up.
by rkratky
commit b87a03aeb9e10e24221950e95b7829627c79434e
Author: Robert Krátký <rkratky(a)redhat.com>
Date: Fri Aug 8 16:21:15 2014 +0200
Fix lang., typos., and mark up.
en-US/publican.xml | 20 ++++++++++----------
1 files changed, 10 insertions(+), 10 deletions(-)
---
diff --git a/en-US/publican.xml b/en-US/publican.xml
index 15e6cc5..94c8fb8 100644
--- a/en-US/publican.xml
+++ b/en-US/publican.xml
@@ -9,7 +9,7 @@
<application>Publican</application> is an open-source publishing system for documentation authored in DocBook XML. It can be used to create and build individual articles and books, manage multiple book sets, or to maintain entire documentation websites. In addition, it can also be used to create RPM packages for easy distribution of documentation builds to other machines.
</para>
<para>
- Publican produces high-quality documents in a number of commonly used file formats such as HTML, PDF, or EPUB. To ensure that all documents produced for a specific project have a consistent look, it uses so called <firstterm>brands</firstterm> to add logos, define color schemes, and set the overall visual style of the output files.
+ Publican produces high-quality documents in a number of commonly used file formats such as HTML, PDF, or EPUB. To ensure that all documents produced for a specific project have a consistent look, it uses so-called <firstterm>brands</firstterm> to add logos, define color schemes, and set the overall visual style of the output files.
</para>
<para>
The Fedora Documentation Project uses Publican to produce all documents located on the <ulink url="http://docs.fedoraproject.org/">Fedora Documentation</ulink> website.
@@ -19,7 +19,7 @@
<para>
To install <application>Publican</application> itself and the <systemitem>fedora</systemitem> brand that is used by the Fedora Documentation Project, type the following at a shell prompt as <systemitem class="username">root</systemitem>:
</para>
- <synopsis><command>yum</command> <option>install</option> <option>publican</option> <option>publican-fedora</option></synopsis>
+ <synopsis><command>yum install publican publican-fedora</command></synopsis>
<para>
By default, only the <systemitem>common</systemitem> brand is installed with the <package>publican</package> package. There are many brands in Fedora repositories, such as <systemitem>oVirt</systemitem> (<package>publican-ovirt</package>), <systemitem>JBoss</systemitem> (<package>publican-jboss</package>), or <systemitem>genome</systemitem> (<package>publican-genome</package>).
</para>
@@ -27,16 +27,16 @@
<section id="sect-publican-creating">
<title>Creating a New Document</title>
<para>
- When creating a new document, <application>Publican</application> allows you to choose between a book and an article. Compared to books, articles have a simpler structure, do not have a preface or a separate title page, and generally tend to be much shorter. Use an article if you intend to write a text with only few pages. For a larger documents, it is usually better to use a book.
+ When creating a new document, <application>Publican</application> allows you to choose between a book and an article. Compared to books, articles have a simpler structure, do not have a preface or a separate title page, and generally tend to be much shorter. Use an article if you intend to write a text with only a few pages. For larger documents, it is usually better to use a book.
</para>
<para>
To create a new book, type the following at a shell prompt:
</para>
- <synopsis><command>publican</command> <option>create</option> <option>--type</option> <option>book</option> <option>--name</option> "<replaceable>Document Name</replaceable>" <option>--brand</option> <replaceable>brand</replaceable></synopsis>
+ <synopsis><command>publican create --type book --name "<replaceable>Document Name</replaceable>" --brand <replaceable>brand</replaceable></command></synopsis>
<para>
Replace <replaceable>Document Name</replaceable> with the document title and <replaceable>brand</replaceable> with the brand you want to use (typically <literal>fedora</literal>). Similarly, to create a new article, run the following command:
</para>
- <synopsis><command>publican</command> <option>create</option> <option>--type</option> <option>article</option> <option>--name</option> "<replaceable>Document Name</replaceable>" <option>--brand</option> <replaceable>brand</replaceable></synopsis>
+ <synopsis><command>publican create --type article --name "<replaceable>Document Name</replaceable>" --brand <replaceable>brand</replaceable></command></synopsis>
<para>
Additionally, you can specify the <option>--lang</option> option followed by a language code (such as <literal>pt-BR</literal> or <literal>cs-CZ</literal>) to write the book in a language different than English.
</para>
@@ -71,7 +71,7 @@
<filename><replaceable>Document_Name</replaceable>.ent</filename>
</entry>
<entry>
- Contains local entities such as <literal>YEAR</literal> and <literal>HOLDER</literal> that are used in the copyright notice.
+ Contains local entities, such as <literal>YEAR</literal> and <literal>HOLDER</literal>, that are used in the copyright notice.
</entry>
</row>
<row>
@@ -159,14 +159,14 @@
<para>
To build a document in order to review it, use the following command:
</para>
- <synopsis><command>publican</command> <option>build</option> <option>--langs</option> <replaceable>languages</replaceable> <option>--formats</option> <replaceable>formats</replaceable></synopsis>
+ <synopsis><command>publican build --langs <replaceable>languages</replaceable> --formats <replaceable>formats</replaceable></command></synopsis>
<para>
Replace <replaceable>languages</replaceable> with a comma-separated list of language codes (such as <literal>en-US</literal> or <literal>cs-CZ</literal>) and <replaceable>formats</replaceable> with a comma-separated list of file formats as described in <xref linkend="tabl-publican-building" />.
</para>
<para>
By default, the <command>publican build</command> command stores the created files in the <filename class="directory">tmp/</filename> directory where you can review the output. To build a final version of the document, add the <option>--publish</option> option as follows:
</para>
- <synopsis><command>publican</command> <option>build</option> <option>--publish</option> <option>--langs</option> <replaceable>languages</replaceable> <option>--formats</option> <replaceable>formats</replaceable></synopsis>
+ <synopsis><command>publican build --publish --langs <replaceable>languages</replaceable> --formats <replaceable>formats</replaceable></command></synopsis>
<para>
This places the generated files in the <filename class="directory">publish/</filename> directory. For information on how to publish your document on the Fedora Documentation website, see <xref linkend="sect-publican-publishing" />.
</para>
@@ -231,7 +231,7 @@
<literal>txt</literal>
</entry>
<entry>
- Generates a plain text file.
+ Generates a plain-text file.
</entry>
</row>
<row>
@@ -312,7 +312,7 @@
</step>
<step>
<para>
- Push the SRPM package created in the previous step to Koji:
+ Push the SRPM package created in the previous step to <application>Koji</application>:
</para>
<synopsis><command>koji build el6-docs <replaceable>package_name</replaceable></command></synopsis>
<para>
9 years, 9 months
[documentation-guide] Fix lang. and typos.
by rkratky
commit 32d089824e3deb8a2f5138c6c2afe94841d6b8fd
Author: Robert Krátký <rkratky(a)redhat.com>
Date: Fri Aug 8 16:03:37 2014 +0200
Fix lang. and typos.
en-US/docbook.xml | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/en-US/docbook.xml b/en-US/docbook.xml
index 8bc4d72..ec9aaeb 100644
--- a/en-US/docbook.xml
+++ b/en-US/docbook.xml
@@ -12,18 +12,18 @@
<section id="sec-Why_DocBook">
<title>Why DocBook?</title>
<para>
- DocBook has many features which make it suitable for documentation in Fedora and other projects.
+ DocBook has many features that make it suitable for documentation in Fedora and other projects.
</para>
<section id="sec-DocBook_as_an_XML_Markup_Language">
<title>DocBook as an XML Markup Language</title>
<para>
- DocBook is an implementation of <firstterm>Extensible Markup Language (XML) </firstterm>. XML gives DocBook powerful flexibility.
+ DocBook is an implementation of <firstterm>Extensible Markup Language (XML)</firstterm>. XML gives DocBook powerful flexibility.
</para>
</section>
<section id="sec-Human-readable_Tags">
<title>Human-readable Tags</title>
<para>
- DocBook tags are generally self-explaining. They are named after what they define, even though shorter terms might make more effiecient use of space. This makes it easy for writers and editors to quickly look at a document and understand how it is constructed.
+ DocBook tags are generally self-explaining. They are named after what they define, even though shorter terms might make more efficient use of space. This makes it easy for writers and editors to quickly look at a document and understand how it is constructed.
</para>
</section>
<section id="sec-Text-based_Format_for_Easy_Revision_Control">
9 years, 9 months