From sradvan at fedoraproject.org Wed Jun 10 15:54:51 2015 Content-Type: multipart/mixed; boundary="===============5267014355845312144==" MIME-Version: 1.0 From: sradvan To: docs-commits at lists.fedoraproject.org Subject: web/html/docs/selinux-faq index.html,NONE,1.1 Date: Wed, 20 Jan 2010 00:27:38 +0000 Message-ID: <20100120002738.C4EE911C00D1@cvs1.fedora.phx.redhat.com> --===============5267014355845312144== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Author: sradvan Update of /cvs/fedora/web/html/docs/selinux-faq In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24364 Added Files: index.html = Log Message: --- NEW FILE index.html --- SELinux FAQ</titl= e><link rel=3D"stylesheet" href=3D"./Common_Content/css/default.css" type= =3D"text/css" /><meta name=3D"generator" content=3D"publican 1.3" /><meta n= ame=3D"package" content=3D"Fedora-SELinux_FAQ-12-en-US-0-0" /><meta name=3D= "description" content=3D"This FAQ answers many questions about Security-Enh= anced Linux. The information in this FAQ is valuable for those who are new = to SELinux." /></head><body class=3D""><p id=3D"title"><a class=3D"left" hr= ef=3D"http://www.fedoraproject.org"><img src=3D"Common_Content/images/image= _left.png" alt=3D"Product Site" /></a><a class=3D"right" href=3D"http://doc= s.fedoraproject.org"><img src=3D"Common_Content/images/image_right.png" alt= =3D"Documentation Site" /></a></p><div xml:lang=3D"en-US" class=3D"article"= title=3D"SELinux FAQ" lang=3D"en-US"><div class=3D"titlepage"><div><div cl= ass=3D"producttitle"><span class=3D"productname">Fedora</span> <span class= =3D"p roductnumber">12</span></div><div><h1 id=3D"chap-SELinux-FAQ-FAQ" class=3D= "title">SELinux FAQ</h1></div><div><h2 class=3D"subtitle">Frequently-asked = questions about Security Enhanced Linux</h2></div><div><h3 class=3D"corpaut= hor"> <span class=3D"inlinemediaobject"><object data=3D"Common_Content/images/t= itle_logo.svg" type=3D"image/svg+xml"> </object></span> </h3></div><div><div xml:lang=3D"en-US" class=3D"authorgroup" lang=3D"en-U= S"><div class=3D"author"><h3 class=3D"author"><span class=3D"firstname">Kar= sten</span> <span class=3D"surname">Wade</span></h3><div class=3D"affiliati= on"><span class=3D"orgname">Fedora</span> <span class=3D"orgdiv">Documentat= ion Project</span></div><code class=3D"email"><a class=3D"email" href=3D"ma= ilto:quaid(a)fedoraproject.org">quaid(a)fedoraproject.org</a></code></div><= div class=3D"author"><h3 class=3D"author"><span class=3D"firstname">Paul W.= </span> <span class=3D"surname">Frields</span></h3><div class=3D"affiliatio= n"><span class=3D"orgname">Fedora</span> <span class=3D"orgdiv">Documentati= on Project</span></div><code class=3D"email"><a class=3D"email" href=3D"mai= lto:pfrields(a)fedoraproject.org">pfrields(a)fedoraproject.org</a></code></= div><div class=3D"author"><h3 class=3D"author"><span class=3D"firstname">Sc= ott</span> <span class=3D"surname">Radvan</span></h3><div class=3D"affiliat= ion"><span class=3D"orgname">Red Hat</span> <span class=3D"orgdiv">Engineer= ing Cont ent Services</span></div><code class=3D"email"><a class=3D"email" href=3D"= mailto:sradvan(a)redhat.com">sradvan(a)redhat.com</a></code></div></div></d= iv><div><div id=3D"id3043795" class=3D"legalnotice"><h1 class=3D"legalnotic= e">Legal Notice</h1><div class=3D"para"> Copyright <span class=3D"trademark"></span>=C2=A9 2010 Red Hat, Inc.. </div><div class=3D"para"> The text of and illustrations in this document are licensed by Red Hat un= der a Creative Commons Attribution=E2=80=93Share Alike 3.0 Unported license= ("CC-BY-SA"). An explanation of CC-BY-SA is available at <a href=3D"http:/= /creativecommons.org/licenses/by-sa/3.0/">http://creativecommons.org/licens= es/by-sa/3.0/</a>. The original authors of this document, and Red Hat, desi= gnate the Fedora Project as the "Attribution Party" for purposes of CC-BY-S= A. In accordance with CC-BY-SA, if you distribute this document or an adapt= ation of it, you must provide the URL for the original version. </div><div class=3D"para"> Red Hat, as the licensor of this document, waives the right to enforce, a= nd agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permi= tted by applicable law. </div><div class=3D"para"> Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix,= Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., regis= tered in the United States and other countries. </div><div class=3D"para"> For guidelines on the permitted uses of the Fedora trademarks, refer to <= a href=3D"https://fedoraproject.org/wiki/Legal:Trademark_guidelines">https:= //fedoraproject.org/wiki/Legal:Trademark_guidelines</a>. </div><div class=3D"para"> <span class=3D"trademark">Linux</span>=C2=AE is the registered trademark = of Linus Torvalds in the United States and other countries. </div><div class=3D"para"> All other trademarks are the property of their respective owners. </div></div></div><div><div class=3D"abstract" title=3D"Abstract"><h6>Abst= ract</h6><div class=3D"para"> This FAQ answers many questions about Security-Enhanced Linux. The information in this FAQ is valuable for those who are new to SELinux. </div></div></div></div><hr /></div><div class=3D"toc"><dl><dt><span class= =3D"section"><a href=3D"#SELinux_FAQ-FAQ-SELinux">1. SELinux</a></span></dt= ></dl></div><div class=3D"para"> For more information about how SELinux works, how to use SELinux for gene= ral and specific Linux distributions, and how to write policy, these resour= ces are useful: </div><div class=3D"itemizedlist"><h6>External Link List</h6><ul><li class= =3D"listitem"><div class=3D"para"> NSA SELinux main website =E2=80=94 <a href=3D"http://www.nsa.gov/selinu= x/">http://www.nsa.gov/selinux/</a> </div></li><li class=3D"listitem"><div class=3D"para"> NSA SELinux FAQ =E2=80=94 <a href=3D"http://www.nsa.gov/selinux/info/fa= q.cfm">http://www.nsa.gov/selinux/info/faq.cfm</a> </div></li><li class=3D"listitem"><div class=3D"para"> SELinux community page =E2=80=94 <a href=3D"http://selinux.sourceforge.= net">http://selinux.sourceforge.net</a> </div></li><li class=3D"listitem"><div class=3D"para"> UnOfficial FAQ =E2=80=94 <a href=3D"http://www.crypt.gen.nz/selinux/faq= .html">http://www.crypt.gen.nz/selinux/faq.html</a> </div></li><li class=3D"listitem"><div class=3D"para"> Writing traditional SE Linux policy HOWTO =E2=80=94 <a href=3D"https://= sourceforge.net/docman/display_doc.php?docid=3D21959&group_id=3D21266">= https://sourceforge.net/docman/display_doc.php?docid=3D21959&group_id= =3D21266</a> </div></li><li class=3D"listitem"><div class=3D"para"> Reference Policy (the new policy found in Fedora 5) =E2=80=94 <a href= =3D"http://serefpolicy.sourceforge.net/">http://serefpolicy.sourceforge.net= /</a> </div></li><li class=3D"listitem"><div class=3D"para"> SELinux policy development training courses =E2=80=94 <a href=3D"http:/= /tresys.com/services/training.shtml">http://tresys.com/services/training.sh= tml</a> and <a href=3D"https://www.redhat.com/training/security/courses/rhs= 429.html">https://www.redhat.com/training/security/courses/rhs429.html</a> </div></li><li class=3D"listitem"><div class=3D"para"> Getting Started with SE Linux HOWTO: the new SELinux (Debian) =E2=80=94= <a href=3D"https://sourceforge.net/docman/display_doc.php?docid=3D20372&am= p;group_id=3D21266">https://sourceforge.net/docman/display_doc.php?docid=3D= 20372&group_id=3D21266</a> </div></li><li class=3D"listitem"><div class=3D"para"> List of SELinux object classes and permissions =E2=80=94 <a href=3D"htt= p://tresys.com/selinux/obj_perms_help.shtml">http://tresys.com/selinux/obj_= perms_help.shtml</a> </div></li><li class=3D"listitem"><div class=3D"para"> On IRC - irc.freenode.net, #fedora-selinux </div></li><li class=3D"listitem"><div class=3D"para"> Fedora mailing list =E2=80=94 <a href=3D"mailto:fedora-selinux-list(a)r= edhat.com">mailto:fedora-selinux-list(a)redhat.com</a>; read the archives o= r subscribe at <a href=3D"http://www.redhat.com/mailman/listinfo/fedora-sel= inux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a> </div></li></ul></div><div class=3D"section" title=3D"1.=C2=A0SELinux"><= div class=3D"titlepage"><div><div><h2 class=3D"title" id=3D"SELinux_FAQ-FAQ= -SELinux">1.=C2=A0SELinux</h2></div></div></div><div class=3D"qandaset" tit= le=3D"Frequently Asked Questions" id=3D"id2913416"><dl><dt></dt><dd><dl><dt= >Q: <a href=3D"#id2913421"> What is SELinux? </a></dt><dt>Q: <a href=3D"#id2914799"> What is SELinux policy? </a></dt><dt>Q: <a href=3D"#id3057481"> What happened to the strict policy? </a></dt><dt>Q: <a href=3D"#id2898184"> What programs are protected by the SELinux policy? </a></dt><dt>Q: <a href=3D"#faq-entry-whatis-refpolicy"> What is the Reference Policy? </a></dt><dt>Q: <a href=3D"#id2898287"> What are file contexts? </a></dt><dt>Q: <a href=3D"#id2916596"> How do I view the security context of a file, user, or process? </a></dt><dt>Q: <a href=3D"#id2916634"> What is the difference between a domain and a type? </a></dt><dt>Q: <a href=3D"#faq-entry-whatare-policy-modules"> What are policy modules? </a></dt><dt>Q: <a href=3D"#faq-entry-whatis-managed-policy"> What is managed policy? </a></dt></dl></dd><dt>1.2. <a href=3D"#id2929042">Controlling SELinu= x</a></dt><dd><dl><dt>Q: <a href=3D"#id2929048"> How do I install/not install SELinux? </a></dt><dt>Q: <a href=3D"#id2929075"> As an administrator, what do I need to do to configure SELinux for my= system? </a></dt><dt>Q: <a href=3D"#qa-using-s-c-securitylevel"> How do I enable/disable SELinux protection on specific daemons under = the targeted policy? </a></dt><dt>Q: <a href=3D"#faq-entry-local.te"> In the past I have written local.te file in policy sources for my own= local customization to policy, how do I do this in Fedora 5? </a></dt><dt>Q: <a href=3D"#id2929497"> I have some avc denials that I would like to allow, how do I do this? </a></dt><dt>Q: <a href=3D"#id2929670"> How can I help write policy? </a></dt><dt>Q: <a href=3D"#id3069707"> How do I switch the policy I am currently using? </a></dt><dt>Q: <a href=3D"#id3069893"> How can I back up files from an SELinux file system? </a></dt><dt>Q: <a href=3D"#faq-entry-public_html"> How do I make a user public_html directory work under SELinux? </a></dt><dt>Q: <a href=3D"#id3070107"> How do I turn SELinux off at boot? </a></dt><dt>Q: <a href=3D"#id3070170"> How do I turn enforcing on/off at boot? </a></dt><dt>Q: <a href=3D"#id3070271"> How do I temporarily turn off enforcing mode without having to reboot? </a></dt><dt>Q: <a href=3D"#id3070304"> How do I turn system call auditing on/off at boot? </a></dt><dt>Q: <a href=3D"#id3070350"> How do I temporarily turn off system-call auditing without having to = reboot? </a></dt><dt>Q: <a href=3D"#id3070377"> How do I get status info about my SELinux installation? </a></dt><dt>Q: <a href=3D"#id3070407"> How do I write policy to allow a domain to use pam_unix.so? </a></dt><dt>Q: <a href=3D"#id3070489"> I created a new Policy Package, where do I put it to make sure that i= t gets loaded into the kernel? </a></dt></dl></dd><dt>1.3. <a href=3D"#faq-div-resolving-problems">R= esolving Problems</a></dt><dd><dl><dt>Q: <a href=3D"#id3070551"> Where are SELinux AVC messages (denial logs, etc.) stored? </a></dt><dt>Q: <a href=3D"#id3070593"> My application isn't working as expected and I am seeing avc: denied = messages. How do I fix this? </a></dt><dt>Q: <a href=3D"#id3070681"> I installed Fedora on a system with an existing /home partition, and = now I can't log in. </a></dt><dt>Q: <a href=3D"#id3070768"> After relabeling my /home using setfiles or fixfiles, am I still be a= ble to read /home with a non-SELinux-enabled system? </a></dt><dt>Q: <a href=3D"#id3070818"> How do I share directories using NFS between Fedora and non-SELinux s= ystems? </a></dt><dt>Q: <a href=3D"#id3070880"> How can I create a new Linux user account with the user's home </a></dt><dt>Q: <a href=3D"#id3070962"> Does the su command change my SELinux identity and role? </a></dt><dt>Q: <a href=3D"#id3071028"> I'm having troubles with avc errors filling my logs for a particular = program. How do I choose not to audit the access for it? </a></dt><dt>Q: <a href=3D"#id3071089"> Even running in permissive mode, I'm getting a large number of avc de= nied messages. </a></dt><dt>Q: <a href=3D"#id3071133"> I get a specific permission denial only when SELinux is in enforcing = mode, but I don't see any audit messages in /var/log/messages (or /var/log/= audit/audit.log if using the audit daemon). How can I identify the cause of= these silent denials? </a></dt><dt>Q: <a href=3D"#id3071241"> Why do I not see the output when I run certain daemons in debug or in= teractive mode? </a></dt><dt>Q: <a href=3D"#id3071332"> When I do an upgrade of the policy package (for example, using yum), = what happens with the policy? Is it updated automatically? </a></dt><dt>Q: <a href=3D"#id3071420"> If the policy shipping with an application package changes in a way t= hat requires relabeling, will RPM handle relabeling the files owned by the = package? </a></dt><dt>Q: <a href=3D"#id3071498"> Why do binary policies distributed with Fedora, such as /etc/selinux/= <policyname>/policy/policy.<version>, and those I compile mysel= f have different sizes and MD5 checksums? </a></dt><dt>Q: <a href=3D"#id3071561"> Will new policy packages disable my system? </a></dt><dt>Q: <a href=3D"#id3071597"> My console is being flooded with messages. How do I turn them off? </a></dt><dt>Q: <a href=3D"#id3071628"> Can I test the default policy without installing the policy source? </a></dt><dt>Q: <a href=3D"#id3071712"> Why are some of my KDE applications having trouble under SELinux? </a></dt><dt>Q: <a href=3D"#id3071784"> Why does SELINUX=3Ddisabled not work for me? </a></dt><dt>Q: <a href=3D"#faq-entry-unconfined_t"> I have a process running as unconfined_t, and SELinux is still preven= ting my application from running. </a></dt><dt>Q: <a href=3D"#id3071992"> What do these rpm errors mean? </a></dt><dt>Q: <a href=3D"#id3072060"> I want to run a daemon on a non standard port but SELinux will not al= low me. How do get this to work? </a></dt><dt>Q: <a href=3D"#id3072095"> I am writing a php script that needs to create files and possibly exe= cute them. SELinux policy is preventing this. What should I do? </a></dt><dt>Q: <a href=3D"#id3072149"> I am setting up swapping to a file, but I am seeing AVC messages in m= y log files? </a></dt><dt>Q: <a href=3D"#id3072186"> Please explain the relabelto/relabelfrom permissions? </a></dt></dl></dd><dt>1.4. <a href=3D"#faq-div-deploying-selinux">De= ploying SELinux</a></dt><dd><dl><dt>Q: <a href=3D"#id3072295"> What file systems can I use for SELinux? </a></dt><dt>Q: <a href=3D"#id3072333"> How does SELinux impact system performance? </a></dt><dt>Q: <a href=3D"#id3072362"> What types of deployments, applications, and systems should I leverag= e SELinux in? </a></dt><dt>Q: <a href=3D"#id3072425"> How does SELinux affect third-party applications? </a></dt></dl></dd></dl><div class=3D"qandaset"><div class=3D"toc"><dl= ><dt>Q: <a href=3D"#id2913421"> What is SELinux? </a></dt><dt>Q: <a href=3D"#id2914799"> What is SELinux policy? </a></dt><dt>Q: <a href=3D"#id3057481"> What happened to the strict policy? </a></dt><dt>Q: <a href=3D"#id2898184"> What programs are protected by the SELinux policy? </a></dt><dt>Q: <a href=3D"#faq-entry-whatis-refpolicy"> What is the Reference Policy? </a></dt><dt>Q: <a href=3D"#id2898287"> What are file contexts? </a></dt><dt>Q: <a href=3D"#id2916596"> How do I view the security context of a file, user, or process? </a></dt><dt>Q: <a href=3D"#id2916634"> What is the difference between a domain and a type? </a></dt><dt>Q: <a href=3D"#faq-entry-whatare-policy-modules"> What are policy modules? </a></dt><dt>Q: <a href=3D"#faq-entry-whatis-managed-policy"> What is managed policy? </a></dt></dl></div><div class=3D"qandadiv"><div class=3D"qandaentry">= <div class=3D"question" id=3D"id2913421"><label>Q:</label><div class=3D"dat= a"><div class=3D"para"> What is SELinux? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> SELinux (<em class=3D"firstterm">Security-Enhanced Linux</em>) in Fed= ora is an implementation of <em class=3D"firstterm">mandatory access contro= l</em> in the Linux kernel using the <em class=3D"firstterm">Linux Security= Modules</em> (<abbr class=3D"abbrev">LSM</abbr>) framework. Standard Linux= security is a <em class=3D"firstterm">discretionary access control</em> mo= del. </div><div class=3D"variablelist"><dl><dt><span class=3D"term">Discret= ionary access control (<abbr class=3D"abbrev">DAC</abbr>)</span></dt><dd><d= iv class=3D"para"> DAC is standard Linux security, and it provides no protection from= broken software or malware running as a normal user or root. Users can gra= nt risky levels of access to files they own. </div></dd><dt><span class=3D"term">Mandatory access control (<abbr= class=3D"abbrev">MAC</abbr>)</span></dt><dd><div class=3D"para"> MAC provides full control over all interactions of software. Admin= istratively defined policy closely controls user and process interactions w= ith the system, and can provide protection from broken software or malware = running as any user. </div></dd></dl></div><div class=3D"para"> In a DAC model, file and resource decisions are based solely on user = identity and ownership of the objects. Each user and program run by that us= er has complete discretion over the user's objects. Malicious or flawed sof= tware can do anything with the files and resources it controls through the = user that started the process. If the user is the super-user or the applica= tion is <code class=3D"command">setuid</code> or <code class=3D"command">se= tgid</code> to root, the process can have root level control over the entir= e file system. </div><div class=3D"para"> A MAC system does not suffer from these problems. First, you can admi= nistratively define a security policy over all processes and objects. Secon= d, you control all processes and objects, in the case of SELinux through th= e kernel. Third, decisions are based on all the security relevant informati= on available, and not just authenticated user identity. </div><div class=3D"para"> MAC under SELinux allows you to provide granular permissions for all = <em class=3D"firstterm">subjects</em> (users, programs, processes) and <em = class=3D"firstterm">objects</em> (files, devices). In practice, think of su= bjects as processes, and objects as the target of a process operation. You = can safely grant a process only the permissions it needs to perform its fun= ction, and no more. </div><div class=3D"para"> The SELinux implementation uses <em class=3D"firstterm">role-based ac= cess control</em> (<abbr class=3D"abbrev">RBAC</abbr>), which provides abst= racted user-level control based on roles, and <em class=3D"firstterm"><span= class=3D"trademark">Type Enforcement</span>=C2=AE</em> (<abbr class=3D"abb= rev">TE</abbr>). TE uses a table, or <em class=3D"firstterm">matrix</em> to= handle access controls, enforcing policy rules based on the types of proce= sses and objects. Process types are called <em class=3D"firstterm">domains<= /em>, and a cross-reference on the matrix of the process's domain and the o= bject's type defines their interaction. This system provides extremely gran= ular control for actors in a Linux system. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id2914799"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> What is SELinux policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The SELinux policy describes the access permissions for all subjects = and objects, that is, the entire system of users, programs, and processes a= nd the files and devices they act upon. Fedora policy is delivered in a pac= kage, with an associated source package. Current shipping policy packages a= re: </div><div class=3D"variablelist"><dl><dt><span class=3D"term"><code c= lass=3D"filename">selinux-policy-<em class=3D"replaceable"><code><versio= n></code></em>.noarch.rpm</code></span></dt><dd><div class=3D"para"> This package is common to all types of policy and contains config = files/man pages. This includes the interface files for the development envi= ronment. This replaces the -sources package from the past. This package con= tains the interface files used in Reference Policy along with a Makefile an= d a small tool called <code class=3D"command">sepolgen</code> used to gener= ate a policy template file. The interface files reside in <code class=3D"fi= lename">/usr/share/selinux/devel/include</code> directory. If you want to s= ee all of the policy files used to build the Reference Policy you need to i= nstall the src.rpm. </div></dd></dl></div></div></div></div><div class=3D"qandaentry"><= div class=3D"question" id=3D"id3057481"><label>Q:</label><div class=3D"data= "><div class=3D"para"> What happened to the strict policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Strict policy since RHEL5 and Fedora Core 5 has been the equivalent o= f targeted policy with the unconfined domains removed. This means all users= had to have a type defined for them like staff_t or user_t. And all proces= ses started by init would need to have policy written for them. As of Fedor= a Core 9, the strict policy was removed and merged into targeted policy. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id2898184"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> What programs are protected by the SELinux policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The number of programs that have SELinux policy defined for them is c= onstantly changing and evolving. Different versions of policy have more or = less executables covered. By convention all confined executables have a lab= el type that ends with exec_t. The SELinux tools package (setools) includes= the seinfo application which allows you to examine the installed policy. = <pre class=3D"screen"> <code class=3D"computeroutput"> # seinfo -t | grep exec_t | wc -l 572 </cod= e> </pre> </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"faq-entry-whatis-refpolicy"><label>Q:</label><div class=3D"data">= <div class=3D"para"> What is the Reference Policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The <em class=3D"firstterm">Reference Policy</em> is a new project ma= intained by Tresys Technology (<a href=3D"http://www.tresys.com/">http://ww= w.tresys.com/</a>) designed to rewrite the entire SELinux policy in a way t= hat is easier to use and understand. To do this, it uses the concepts of mo= dularity, abstraction, and well-defined interfaces. Refer to <a href=3D"htt= p://serefpolicy.sourceforge.net/">http://serefpolicy.sourceforge.net/</a> f= or more information on the Reference Policy. </div><div class=3D"para"> Note that Reference Policy is not a new type of policy. Rather, it is= a new base that policies can be built from. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id2898287"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> What are file contexts? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> <em class=3D"firstterm">File contexts</em> are used by the <code clas= s=3D"command">setfiles</code> command to generate persistent labels which d= escribe the security context for a file or directory. </div><div class=3D"para"> Fedora ships with the <code class=3D"command">fixfiles</code> script,= which supports three options: <code class=3D"option">check</code>, <code c= lass=3D"option">restore</code>, and <code class=3D"option">relabel</code>. = This script allows users to relabel the file system without having the <cod= e class=3D"filename">selinux-policy-targeted-sources</code> package install= ed. The command line usage is more friendly than the standard <code class= =3D"command">setfiles</code> command. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id2916596"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I view the security context of a file, user, or process? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The new option <code class=3D"option">-Z</code> is the short method f= or displaying the context of a subject or object: </div><pre class=3D"screen"> <code class=3D"command">ls -alZ <em class=3D"replaceable"><code>file.foo</c= ode></em> id -Z ps -eZ</code> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id2916634"><label>Q:</label><div class=3D"data"><div class=3D"para"> What is the difference between a <em class=3D"firstterm">domain</em> = and a <em class=3D"firstterm">type</em>? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> There is no difference between a domain and a type, although domain i= s sometimes used to refer to the type of a process. The use of domain in th= is way stems from Domain and Type Enforcement (DTE) models, where domains a= nd types are separate. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"faq-entry-whatare-policy-modules"><label>Q:</label><div class=3D"= data"><div class=3D"para"> What are policy modules? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Prior to Fedora 5, SELinux policies were monolithic, meaning making a= change required getting the entire policy source, modifying it, compiling = it, and replacing the current policy with it. With Fedora 5, the policy is = now modular. This means that third party developers can ship policy modules= with their applications, and then they can be added to the policy without = having to switch out the entire policy. The new module is then added to the= module store, which results in a new policy binary that is a combination o= f the previous policy and the new module. </div><div class=3D"para"> This actually works by separating out compile and link steps in the p= olicy build procedure. Policy modules are compiled from source, and linked = when installed into the module store (see <a class=3D"xref" href=3D"#faq-en= try-whatis-managed-policy" title=3D"Q:">Managed Policy</a>). This linked po= licy is then loaded into the kernel for enforcement. </div><div class=3D"para"> The primary command for dealing with modules is <code class=3D"comman= d">semodule</code>, which lets you perform basic functions such as installi= ng, upgrading, or removing modules. Other useful commands include <code cla= ss=3D"command">checkmodule</code>, which is the module compiler and is inst= alled with the checkpolicy rpm, as well as <code class=3D"command">semodule= _package</code>, which creates a policy package file (.pp) from a compiled = policy module. </div><div class=3D"para"> Modules are usually stored as policy package file (.pp extension) in = <code class=3D"filename">/usr/share/selinux/<em class=3D"replaceable"><code= >policyname</code></em>/</code>. There you should at least find the base.pp= , which is the base module. </div><div class=3D"para"> To see how to write a simple policy module, check out <a class=3D"xre= f" href=3D"#faq-entry-local.te" title=3D"Q:">Local Policy Customizations</a= >. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"faq-entry-whatis-managed-policy"><label>Q:</label><div class=3D"d= ata"><div class=3D"para"> What is managed policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Prior to Fedora 5, SELinux policies were handled as user-editable con= fig files in etc. Unfortunately, this made it difficult to address many of = the usability issues arising with SELinux. So, a new library, <code class= =3D"filename">libsemanage</code>, was added to provide userspace tools an i= nterface to making policy management easier. All policy management should u= se this library to access the policy store. The policy store holds all the = policy information, and is found at <code class=3D"filename">/etc/selinux/<= em class=3D"replaceable"><code>policyname</code></em>/modules/</code>. </div><div class=3D"para"> You should never have to edit the store directly. Instead, you should= use tools that link against libsemanage. One example tool is <code class= =3D"command">semanage</code>, which is a command line tool for managing muc= h of the policy such as SELinux user mappings, SELinux port mappings, and f= ile contexts entries. Other examples of tools that use libsemanage include = <code class=3D"command">semodule</code> which uses it to manage the SELinux= policy modules installed to the policy store and <code class=3D"command">s= etsebool</code> which uses it manage SELinux policy booleans. Additionally,= graphical tools are currently being developed to utilize the functionality= provided by libsemanage. </div></div></div></div></div><div class=3D"qandadiv"><h4 class=3D"tit= le" id=3D"id2929042">1.2. Controlling SELinux</h4></div><div class=3D"toc">= <dl><dt>Q: <a href=3D"#id2929048"> How do I install/not install SELinux? </a></dt><dt>Q: <a href=3D"#id2929075"> As an administrator, what do I need to do to configure SELinux for my= system? </a></dt><dt>Q: <a href=3D"#qa-using-s-c-securitylevel"> How do I enable/disable SELinux protection on specific daemons under = the targeted policy? </a></dt><dt>Q: <a href=3D"#faq-entry-local.te"> In the past I have written local.te file in policy sources for my own= local customization to policy, how do I do this in Fedora 5? </a></dt><dt>Q: <a href=3D"#id2929497"> I have some avc denials that I would like to allow, how do I do this? </a></dt><dt>Q: <a href=3D"#id2929670"> How can I help write policy? </a></dt><dt>Q: <a href=3D"#id3069707"> How do I switch the policy I am currently using? </a></dt><dt>Q: <a href=3D"#id3069893"> How can I back up files from an SELinux file system? </a></dt><dt>Q: <a href=3D"#faq-entry-public_html"> How do I make a user public_html directory work under SELinux? </a></dt><dt>Q: <a href=3D"#id3070107"> How do I turn SELinux off at boot? </a></dt><dt>Q: <a href=3D"#id3070170"> How do I turn enforcing on/off at boot? </a></dt><dt>Q: <a href=3D"#id3070271"> How do I temporarily turn off enforcing mode without having to reboot? </a></dt><dt>Q: <a href=3D"#id3070304"> How do I turn system call auditing on/off at boot? </a></dt><dt>Q: <a href=3D"#id3070350"> How do I temporarily turn off system-call auditing without having to = reboot? </a></dt><dt>Q: <a href=3D"#id3070377"> How do I get status info about my SELinux installation? </a></dt><dt>Q: <a href=3D"#id3070407"> How do I write policy to allow a domain to use pam_unix.so? </a></dt><dt>Q: <a href=3D"#id3070489"> I created a new Policy Package, where do I put it to make sure that i= t gets loaded into the kernel? </a></dt></dl></div><div class=3D"qandadiv"><div class=3D"qandaentry">= <div class=3D"question" id=3D"id2929048"><label>Q:</label><div class=3D"dat= a"><div class=3D"para"> How do I install/not install SELinux? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The installer follows the choice you make in the <span class=3D"guila= bel"><strong>Firewall Configuration</strong></span> screen. The default run= ning policy is the targeted policy, and it is on by default. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id2929075"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> As an administrator, what do I need to do to configure SELinux for my= system? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The answer might be nothing. There are many Fedora users that don't e= ven realize that they are using SELinux. SELinux provides protection for th= eir systems with an out-of-the-box configuration. That said, there are a co= uple of things an administrator might want to do to configure their system.= These include: </div><div class=3D"variablelist"><dl><dt><span class=3D"term">boolean= s</span></dt><dd><div class=3D"para"> Booleans are settings that can be flipped to alter SELinux policy = behavior without having to write new policy. There are many booleans that c= an be set in Fedora, and they allow an administrator to configure SELinux t= o a great degree. To view the available booleans and modify their settings,= use <code class=3D"command">system-config-selinux</code> or the command li= ne tool <code class=3D"command">setsebool</code>. </div></dd><dt><span class=3D"term">setting customizable file conte= xts</span></dt><dd><div class=3D"para"> Files on an SELinux system have a security context which is stored= in the extended attribute of the file (behavior can vary from filesystem t= o filesystem, but this is how ext3 works). These are set by <code class=3D"= command">rpm</code> automatically, but sometimes a user might want to set a= particular context on a file. An example would be setting the context on a= <code class=3D"filename">public_html</code> directory so that <code class= =3D"command">apache</code> can access it, as illustrated in <a class=3D"xre= f" href=3D"#faq-entry-public_html" title=3D"Q:">How do I make a user public= _html directory work under SELinux</a>. </div><div class=3D"para"> For a list of types that you might want to assign to files, see <c= ode class=3D"filename">/etc/selinux/targeted/contexts/customizable_types</c= ode>. These are types commonly assigned to files by users and administrator= s. To set these, use the <code class=3D"command">chcon</code> command. Note= that the types in <code class=3D"filename">customizable_types</code> are a= lso preserved after a relabel, so relabeling the system will not undo this. </div></dd><dt><span class=3D"term">making badly behaving libraries= work</span></dt><dd><div class=3D"para"> There are many libraries around that behave badly and try to break= the memory protections SELinux provides. These libraries should really be = fixed, so please file a bug with the library maintainer. That said, they ca= n be made to work. More information and solutions to make the libraries wor= k can be found in <a class=3D"xref" href=3D"#faq-entry-unconfined_t" title= =3D"Q:">I have a process running as unconfined_t, and SELinux is still prev= enting my application from running</a>. </div></dd></dl></div></div></div></div><div class=3D"qandaentry"><= div class=3D"question" id=3D"qa-using-s-c-securitylevel"><label>Q:</label><= div class=3D"data"><div class=3D"para"> How do I enable/disable SELinux protection on specific daemons under = the targeted policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Use <code class=3D"command">system-config-selinux</code>, also known = as the <span class=3D"application"><strong>Security Level Configuration</st= rong></span> graphical tool, to control the Boolean values of specific daem= ons. For example, if you need to disable SELinux for Apache to run correctl= y in your environment, you can disable the value in <code class=3D"command"= >system-config-selinux</code>. This change disables the transition to the p= olicy defined in <code class=3D"filename">apache.te</code>, allowing <code = class=3D"command">httpd</code> to remain under regular Linux DAC security. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"faq-entry-local.te"><label>Q:</label><div class=3D"data"><div cla= ss=3D"para"> In the past I have written local.te file in policy sources for my own= local customization to policy, how do I do this in Fedora 5? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Since Fedora 5 uses a modular policy, you don't have to have the comp= lete policy source any more. Now, you can just create a local policy module= for your local policy customizations. To do this, follow these steps. </div><div class=3D"procedure"><ol class=3D"1"><li class=3D"step" titl= e=3D"Step 1"><div class=3D"para"> Create a temporary directory, and change into it. </div><pre class=3D"screen"> <code class=3D"computeroutput">$ mkdir foo $ cd foo</code> </pre></li><li class=3D"step" title=3D"Step 2"><div class=3D"para"> Create empty te, if, and fc files. </div><pre class=3D"screen"> <code class=3D"computeroutput">$ touch local.te local.if local.fc</code> </pre></li><li class=3D"step" title=3D"Step 3"><div class=3D"para"> Edit the local.te file, adding appropriate content. For example: </div><pre class=3D"screen"> policy_module(local, 1.0) require { attribute httpdcontent; type smbd_t; } allow smbd_t httpdcontent:dir create_dir_perms; allow smbd_t httpdcontent:{ file lnk_file } create_file_perms; </pre><div class=3D"para"> There are 3 parts to this file. </div><div class=3D"itemizedlist"><ul><li class=3D"listitem"><div cl= ass=3D"para"> The <code class=3D"computeroutput">policy_module</code> call inse= rts statements to make the module work, including declaring the module and = requiring system roles, classes, and permissions. Make sure the name declar= ed here (local in this case) matches the name you gave the file (local.te). </div></li><li class=3D"listitem"><div class=3D"para"> The <code class=3D"computeroutput">require</code> block lists the= symbols that this module uses that must be declared in other modules. In t= his case, we require the attribute <code class=3D"computeroutput">httpdcont= ent</code> and the type <code class=3D"computeroutput">smbd_t</code>. Note = that all types and attributes you use in rules must be required here unless= you are declaring them yourself below. </div></li><li class=3D"listitem"><div class=3D"para"> The rest of the file is the policy, in this case consisting only = of a couple of allow rules. You could also place type declarations, dontaud= it statements, interface calls, or most things that can go in a normal te f= ile here. </div></li></ul></div></li><li class=3D"step" title=3D"Step 4"><di= v class=3D"para"> Build the policy module. </div><pre class=3D"screen"> $ make -f /usr/share/selinux/devel/Makefile Compliling targeted local module /usr/bin/checkmodule: loading policy configuration from tmp/local.tmp /usr/bin/checkmodule: policy configuration loaded /usr/bin/checkmodule: writing binary representation (version 5) to tmp/loc= al.mod Creating targeted local.pp policy package rm tmp/local.mod.fc tmp/local.mod </pre><div class=3D"para"> Note that this uses <code class=3D"command">checkmodule</code>, whi= ch is part of the checkpolicy rpm. So, make sure you install this rpm befor= e doing this. </div></li><li class=3D"step" title=3D"Step 5"><div class=3D"para"> Become root, and install the policy module with <code class=3D"comm= and">semodule</code>. </div><pre class=3D"screen"> <code class=3D"computeroutput">$ su Password: # semodule -i local.pp</code> </pre></li></ol></div><div class=3D"note"><h2>Module are uniquely identifie= d by name</h2><div class=3D"para"> This means that if you later insert another <code class=3D"filename"= >local.pp</code>, it will replace the one you just loaded. So, you should k= eep this <code class=3D"filename">local.te</code> around, and just add to i= t if you need to make later policy customizations. If you lose it, but want= to keep your previous policy around, just call the new local policy module= something else (say local2.te). </div></div></div></div></div><div class=3D"qandaentry"><div class=3D= "question" id=3D"id2929497"><label>Q:</label><div class=3D"data"><div class= =3D"para"> I have some avc denials that I would like to allow, how do I do this? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> If you have specific AVC messages you can use <code class=3D"command"= >audit2allow</code> to generate a Type Enforcement file that is ready to lo= ad as a policy module. </div><pre class=3D"screen"> <code class=3D"command">audit2allow -M local < /tmp/avcs</code> </pre><div class=3D"para"> This creates a <code class=3D"filename">local.pp</code> which you can= then load into the kernel using <code class=3D"command">semodule -i local.= pp</code>. You can also edit the <code class=3D"filename">local.te</code> t= o make additional customizations. To create a module allowing all the denia= ls since the last reboot that you can then customize, execute the following: </div><pre class=3D"screen"> <code class=3D"command">audit2allow -m local -l -i /var/log/messages > l= ocal.te</code> </pre><div class=3D"para"> Note that the above assumes you are not using the audit daemon. If yo= u were using the audit daemon, then you should use <code class=3D"filename"= >/var/log/audit/audit.log</code> instead of <code class=3D"filename">/var/l= og/messages</code> as your log file. This generates a <code class=3D"filena= me">local.te</code> file, that looks similar to the following: </div><pre class=3D"screen"> module local 1.0; require { class file { append execute execute_no_trans getattr ioctl read wri= te }; type httpd_t; type httpd_w3c_script_exec_t; }; allow httpd_t httpd_w3c_script_exec_t:file { execute execute_no_trans getat= tr ioctl read }; </pre><div class=3D"para"> You can hand edit this file, removing allow statements that you don't= want to allow, and then recompile and reload it using </div><div class=3D"itemizedlist"><ul><li class=3D"listitem"><div clas= s=3D"para"> <code class=3D"command">checkmodule -M -m -o local.mod local.te</co= de> to compile the te file. Note that <code class=3D"command">checkmodule</= code> is part of the checkpolicy rpm, so you need to have it installed. </div></li><li class=3D"listitem"><div class=3D"para"> <code class=3D"command">semodule_package -o local.pp -m local.mod</= code> to create a policy package. </div></li><li class=3D"listitem"><div class=3D"para"> <code class=3D"command">semodule -i local.pp</code> to add it to th= e current machine's running policy. This installs a new module called local= with these rules into the module store. </div></li></ul></div><div class=3D"note"><h2>Important</h2><div cla= ss=3D"para"> In order to load this newly created policy package into the kernel, = you are required to execute <code class=3D"command">semodule -i local.pp</c= ode> </div><div class=3D"para"> Note that if you later install another module called local, it will = replace this module. If you want to keep these rules around, then you eithe= r need to append future customizations to this local.te, or give future cus= tomizations a different name. </div></div></div></div></div><div class=3D"qandaentry"><div class=3D= "question" id=3D"id2929670"><label>Q:</label><div class=3D"data"><div class= =3D"para"> How can I help write policy? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Your help is definitely appreciated. </div><div class=3D"itemizedlist"><ul><li class=3D"listitem"><div clas= s=3D"para"> You can start by joining the Fedora SELinux mailing list. You can s= ubscribe and read the archives at <a href=3D"http://www.redhat.com/mailman/= listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora= -selinux-list</a>. </div></li><li class=3D"listitem"><div class=3D"para"> The Unofficial FAQ has some generic policy writing HOWTO informatio= n. Refer to <a href=3D"http://sourceforge.net/docman/display_doc.php?docid= =3D14882&group_id=3D21266#BSP.1">http://sourceforge.net/docman/display_= doc.php?docid=3D14882&group_id=3D21266#BSP.1</a> for more information. </div></li><li class=3D"listitem"><div class=3D"para"> Another new resource is the Writing SE Linux policy HOWTO, located = online at <a href=3D"https://sourceforge.net/docman/display_doc.php?docid= =3D21959&group_id=3D21266">https://sourceforge.net/docman/display_doc.p= hp?docid=3D21959&group_id=3D21266</a>. </div></li></ul></div><div class=3D"para"> Also, since the Fedora policy is based on the <a class=3D"xref" href= =3D"#faq-entry-whatis-refpolicy" title=3D"Q:">Reference Policy</a>, you sho= uld look at the documentation on its project page. Another excellent source= of information is the example policy files in <code class=3D"filename">/us= r/share/doc/selinux-policy-<em class=3D"replaceable"><code>>version<<= /code></em></code> and <code class=3D"filename">/usr/share/selinux/devel</c= ode>. </div><div class=3D"para"> If you want to create a new policy domain, you can look at the interf= ace files in the <code class=3D"filename">/usr/share/selinux/devel</code> s= ub-directories. There is also a tool there to help you get started. The fol= lowing procedure is an example: </div><div class=3D"procedure"><ol class=3D"1"><li class=3D"step" titl= e=3D"Step 1"><div class=3D"para"> Use the <code class=3D"command">sepolgen</code> command to generate= your own <code class=3D"filename">te</code>, <code class=3D"filename">fc</= code> and <code class=3D"filename">if</code> files. The <code class=3D"comm= and">sepolgen</code> command takes two parameters: the name of the policy m= odule and the full path to the executable. The following command gives a us= age example: </div><pre class=3D"screen"> <code class=3D"command">sepolgen <em class=3D"replaceable"><code>mydaemon /= usr/sbin/mydaemon</code></em></code> </pre><div class=3D"para"> It will prompt you for a few common domain characteristics, and wil= l create three files: <code class=3D"filename">mydaemon.te</code>, <code cl= ass=3D"filename">mydaemon.fc</code> and <code class=3D"filename">mydaemon.i= f</code>. </div></li><li class=3D"step" title=3D"Step 2"><div class=3D"para"> After you generate the policy files, use the supplied Makefile, <co= de class=3D"filename">/usr/share/selinux/devel/Makefile</code>, to build a = policy package (<code class=3D"filename">mydaemon.pp</code>): </div><pre class=3D"screen"> <code class=3D"command">make -f /usr/share/selinux/devel/Makefile</code> </pre></li><li class=3D"step" title=3D"Step 3"><div class=3D"para"> Now you can load the policy module, using <code class=3D"command">s= emodule</code>, and relabel the executable using <code class=3D"command">re= storecon</code>: </div><pre class=3D"screen"> <code class=3D"command">semodule -i <em class=3D"replaceable"><code>mydaemo= n.pp</code></em></code> <code class=3D"command">restorecon -v <em class=3D"replaceable"><code>/usr/= sbin/mydaemon</code></em></code> </pre></li><li class=3D"step" title=3D"Step 4"><div class=3D"para"> Since you have very limited policy for your executable, SELinux wil= l prevent it from doing much. Turn on permissive mode and then use the init= script to start your daemon: </div><pre class=3D"screen"> <code class=3D"command">setenforce 0</code> <code class=3D"command">service <em class=3D"replaceable"><code>mydaemon</c= ode></em> restart</code> </pre></li></ol></div><div class=3D"para"> Now you can collect avc messages. You can use <code class=3D"command"= >audit2allow</code> to translate the avc messages to allow rules and begin = updating your <code class=3D"filename">mydaemon.te</code> file. You should = search for interface macros in the <code class=3D"filename">/usr/share/seli= nux/devel/include</code> directory and use these instead of using the allow= rules directly, whenever possible. <code class=3D"command">audit2allow -R<= /code> will attempt to find interfaces that match the allow rule. If you wa= nt more examples of policy, you could always install the selinux-policy src= rpm, which contains all of the policy te files for the reference policy. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3069707"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I switch the policy I am currently using? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"caution"><h2>Use caution when switching policy</h2><di= v class=3D"para"> Other than trying out a new policy on a test machine for research pur= poses, you should seriously consider your situation before switching to a d= ifferent policy on a production system. The act of switching is straightfor= ward. This method is fairly safe, but you should try it first on a test sys= tem. </div></div><div class=3D"para"> To use the automated method, run the <span class=3D"application"><str= ong>Security Level Configuration</strong></span> tool. From the GUI Main Me= nu, select <span class=3D"guimenu"><strong>Desktop</strong></span> =E2=86= =92 <span class=3D"guisubmenu"><strong>System Settings</strong></span> =E2= =86=92 <span class=3D"guimenuitem"><strong>Security level</strong></span>, = or from a terminal, run <code class=3D"command">system-config-selinux</code= >. Change the policy as desired and ensure that the <span class=3D"guilabel= "><strong>Relabel on next reboot</strong></span> option is enabled. </div><div class=3D"para"> You can also perform these steps manually with the following procedur= e: </div><div class=3D"procedure"><ol class=3D"1"><li class=3D"step" titl= e=3D"Step 1"><div class=3D"para"> Edit <code class=3D"filename">/etc/selinux/config</code> and change= the type and the mode of policy: </div><pre class=3D"screen"> <strong class=3D"userinput"><code>SELINUXTYPE=3D<em class=3D"replaceable"><= code>policyname</code></em> SELINUX=3Dpermissive</code></strong> </pre><div class=3D"para"> This step ensures are not locked out after rebooting. SELinux runs = under the correct policy, but does allow you to login if there is a problem= such as incorrect file context labeling. </div></li><li class=3D"step" title=3D"Step 2"><div class=3D"para"> Set the system to relabel the file system on reboot: </div><pre class=3D"screen"> <code class=3D"command">touch /.autorelabel</code> </pre></li><li class=3D"step" title=3D"Step 3"><div class=3D"para"> Reboot the system. A clean restart under the new policy allows all = system processes to be started in the proper context, and reveals any probl= ems in the policy change. </div></li><li class=3D"step" title=3D"Step 4"><div class=3D"para"> Confirm your changes took effect with the following command: </div><pre class=3D"screen"> <code class=3D"command">sestatus -v</code> </pre><div class=3D"para"> With the new system running in <code class=3D"computeroutput">permi= ssive</code> mode, check <code class=3D"filename">/var/log/messages</code> = for <code class=3D"computeroutput">avc: denied</code> messages. These may i= ndicate a problem that needs to be solved for the system to run without tro= uble under the new policy. </div></li><li class=3D"step" title=3D"Step 5"><div class=3D"para"> When you are satisfied that the system runs stable under the new po= licy, enable enforcing by changing <code class=3D"computeroutput">SELINUX= =3Denforcing</code>. You can either reboot or run <code class=3D"command">s= etenforce 1</code> to turn enforcing on in real time. </div></li></ol></div></div></div></div><div class=3D"qandaentry"><d= iv class=3D"question" id=3D"id3069893"><label>Q:</label><div class=3D"data"= ><div class=3D"para"> How can I back up files from an SELinux file system? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You can now use the <code class=3D"command">tar</code> command, you d= o not need to use <code class=3D"command">star</code>. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"faq-entry-public_html"><label>Q:</label><div class=3D"data"><div = class=3D"para"> How do I make a user <code class=3D"filename">public_html</code> dire= ctory work under SELinux? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> This process presumes that you have enabled user public HTML director= ies in your Apache configuration file, <code class=3D"filename">/etc/httpd/= conf/httpd.conf</code>. This process only covers serving static Web content= . For more information about Apache; and SELinux, refer to <a href=3D"http:= //fedora.redhat.com/docs/selinux-apache-fc3/">http://fedora.redhat.com/docs= /selinux-apache-fc3/</a>. </div><div class=3D"procedure"><ol class=3D"1"><li class=3D"step" titl= e=3D"Step 1"><div class=3D"para"> If you do not already have a <code class=3D"filename">~/public_html= </code> directory, create it and populate it with the files and folders to = be served. </div><pre class=3D"screen"> <strong class=3D"userinput"><code>cd ~ mkdir public_html cp /path/to/conten= t ~/public_html</code></strong> </pre></li><li class=3D"step" title=3D"Step 2"><div class=3D"para"> At this point, <code class=3D"command">httpd</code> is configured t= o serve the contents, but you still receive a <code class=3D"computeroutput= ">403 forbidden</code> error. This is because <code class=3D"command">httpd= </code> is not allowed to read the security type for the directory and file= s as they are created in the user's home directory. Change the security con= text of the folder and its contents recursively using the <code class=3D"op= tion">-R</code> option: </div><pre class=3D"screen"> <strong class=3D"userinput"><code>ls -Z -d public_html/</code></strong> <code class=3D"computeroutput">drwxrwxr-x auser auser user_u:object_r:user_= home_t public_html</code> <strong class=3D"userinput"><code>chcon -R -t httpd_user_content_t public_h= tml/ ls -Z -d public_html/</code></strong> <code class=3D"computeroutput">drwxrwxr-x auser auser user_u:object_r:httpd= _user_content_t public_html/</code> <strong class=3D"userinput"><code>ls -Z public_html/</code></strong> <code class=3D"computeroutput">-rw-rw-r-- auser auser user_u:object_r:httpd= _user_content_t bar.html</code> <code class=3D"computeroutput">-rw-rw-r-- auser auser user_u:object_r:httpd= _user_content_t baz.html</code> <code class=3D"computeroutput">-rw-rw-r-- auser auser user_u:object_r:httpd= _user_content_t foo.html</code> </pre><div class=3D"para"> You may notice at a later date that the user field, set here to <co= de class=3D"computeroutput">user_u</code>, is changed to <code class=3D"com= puteroutput">system_u</code>. This does not affect how the targeted policy = works. The field that matters is the type field. </div></li><li class=3D"step" title=3D"Step 3"><div class=3D"para"> Your static webpages should now be served correctly. If you continu= e to have errors, ensure that the Boolean which enables user home directori= es is enabled. You can set it using <code class=3D"command">system-config-s= elinux</code>. Select the <span class=3D"guilabel"><strong>SELinux</strong>= </span> tab, and then select the <span class=3D"guilabel"><strong>Modify SE= Linux Policy</strong></span> area. Select <code class=3D"computeroutput">Al= low HTTPD to read home directories</code>. The changes take effect immediat= ely. </div></li></ol></div></div></div></div><div class=3D"qandaentry"><d= iv class=3D"question" id=3D"id3070107"><label>Q:</label><div class=3D"data"= ><div class=3D"para"> How do I turn SELinux off at boot? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Set <code class=3D"computeroutput">SELINUX=3Ddisabled</code> in <code= class=3D"filename">/etc/selinux/config</code>. </div><div class=3D"para"> Alternatively, you can add <code class=3D"option">selinux=3D0</code> = to your kernel boot parameters. However, this option is not recommended. </div><div class=3D"caution"><h2>Be careful when disabling SELinux</h2= ><div class=3D"para"> If you boot with <code class=3D"option">selinux=3D0</code>, any files= you create while SELinux is disabled do not have SELinux context informati= on. The file system is marked for relabeling at the next boot. If an unfore= seen problem prevents you from rebooting normally, you may need to boot in = single-user mode for recovery. Add the option <code class=3D"option">emerge= ncy</code> to your kernel boot parameters. </div></div></div></div></div><div class=3D"qandaentry"><div class=3D"= question" id=3D"id3070170"><label>Q:</label><div class=3D"data"><div class= =3D"para"> How do I turn enforcing on/off at boot? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You can specify the SELinux mode using the configuration file <code c= lass=3D"filename">/etc/sysconfig/selinux</code>. </div><pre class=3D"screen"> # This file controls the state of SELinux on the system. # SELINUX=3D can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=3D<strong class=3D"userinput"><code><em class=3D"replaceable"><code= >enforcing</code></em></code></strong> # SELINUXTYPE=3D can take one of these two values: # targeted - Only targeted network daemons are protected. # mls - Multi Level Security protection. SELINUXTYPE=3D<strong class=3D"userinput"><code><em class=3D"replaceable"><= code>targeted</code></em></code></strong> </pre><div class=3D"para"> Setting the value to <code class=3D"computeroutput">enforcing</code> = is the same as adding <code class=3D"option">enforcing=3D1</code> to the ke= rnel boot parameters. Setting the value to <code class=3D"computeroutput">p= ermissive</code> is the same as adding <code class=3D"option">enforcing=3D0= </code> to the kernel boot parameters. </div><div class=3D"para"> However, setting the value to <code class=3D"computeroutput">disabled= </code> is not the same as the <code class=3D"option">selinux=3D0</code> ke= rnel boot parameter. Rather than fully disabling SELinux in the kernel, the= <code class=3D"computeroutput">disabled</code> setting instead turns enfor= cing off and skips loading a policy. </div><div class=3D"important"><h2>SELinux Configuration Precedence</h= 2><div class=3D"para"> The command line kernel parameter overrides the configuration file. </div></div></div></div></div><div class=3D"qandaentry"><div class=3D= "question" id=3D"id3070271"><label>Q:</label><div class=3D"data"><div class= =3D"para"> How do I temporarily turn off enforcing mode without having to reboot? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Occasionally you may need to perform an action that is normally preve= nted by policy. Run the command <code class=3D"command">setenforce 0</code>= to turn off enforcing mode in real time. When you are finished, run <code = class=3D"command">setenforce 1</code> to turn enforcing back on. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070304"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I turn system call auditing on/off at boot? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Add <code class=3D"option">audit=3D1</code> to your kernel command li= ne to turn system call auditing on. Add <code class=3D"option">audit=3D0</c= ode> to your kernel command line to turn system call auditing off. </div><div class=3D"para"> System-call auditing is <span class=3D"emphasis"><em>on</em></span> b= y default. When on, it provides information about the system call that was = executing when SELinux generated a <code class=3D"computeroutput">denied</c= ode> message. The error message is helpful when debugging policy. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070350"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I temporarily turn off system-call auditing without having to = reboot? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Run <code class=3D"command">auditctl -e 0</code>. Note that this comm= and does not affect auditing of SELinux AVC denials. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070377"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I get status info about my SELinux installation? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> As root, execute the command <code class=3D"command">/usr/sbin/sestat= us -v</code>. For more information, refer to the <code class=3D"filename">s= estatus(8)</code> manual page. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070407"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I write policy to allow a domain to use pam_unix.so? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Very few domains in the SELinux world are allowed to read the <code c= lass=3D"filename">/etc/shadow</code> file. There are constraint rules that = prevent policy writers from writing code like </div><pre class=3D"screen"> <code class=3D"command">allow mydomain_t shadow_t:file read;</code> </pre><div class=3D"para"> In RHEL4 you can setup your domain to use the <code class=3D"command"= >unix_chkpwd</code> command. The easiest way is to use the <code class=3D"c= ommand">unix_chkpwd</code> attribute. So if you were writing policy for an = ftpd daemon you would write something like </div><pre class=3D"screen"> <code class=3D"command">daemon_domain(vsftpd, `auth_chkpwd')</code> </pre><div class=3D"para"> This would create a context where vsftpd_t -> chkpwd_exec_t -> = system_chkpwd_t which can read <code class=3D"filename">/etc/shadow</code>,= while vsftpd_t is not able to read it. </div><div class=3D"para"> In Fedora /RHEL5, add the rule </div><pre class=3D"screen"> <code class=3D"command">auth_domtrans_chk_passwd(vsftpd_t)</code> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id3070489"><label>Q:</label><div class=3D"data"><div class=3D"para"> I created a new Policy Package, where do I put it to make sure that i= t gets loaded into the kernel? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You need to execute the command <code class=3D"command">semodule -i m= yapp.pp</code>. This modifies the policy that is stored on the machine. You= r policy module now is loaded with the rest of the policy. You can even rem= ove the pp file from the system. </div><div class=3D"para"> <code class=3D"command">semodule -l</code> lists the currently loaded= modules. </div><pre class=3D"screen"> <code class=3D"computeroutput">#semodule -i myapp 1.2.1</code> </pre><div class=3D"para"> If you later would like to remove the policy package, you can execute= <code class=3D"command">semodule -r myapp</code>. </div></div></div></div></div><div class=3D"qandadiv"><h4 class=3D"tit= le" id=3D"faq-div-resolving-problems">1.3. Resolving Problems</h4></div><di= v class=3D"toc"><dl><dt>Q: <a href=3D"#id3070551"> Where are SELinux AVC messages (denial logs, etc.) stored? </a></dt><dt>Q: <a href=3D"#id3070593"> My application isn't working as expected and I am seeing avc: denied = messages. How do I fix this? </a></dt><dt>Q: <a href=3D"#id3070681"> I installed Fedora on a system with an existing /home partition, and = now I can't log in. </a></dt><dt>Q: <a href=3D"#id3070768"> After relabeling my /home using setfiles or fixfiles, am I still be a= ble to read /home with a non-SELinux-enabled system? </a></dt><dt>Q: <a href=3D"#id3070818"> How do I share directories using NFS between Fedora and non-SELinux s= ystems? </a></dt><dt>Q: <a href=3D"#id3070880"> How can I create a new Linux user account with the user's home </a></dt><dt>Q: <a href=3D"#id3070962"> Does the su command change my SELinux identity and role? </a></dt><dt>Q: <a href=3D"#id3071028"> I'm having troubles with avc errors filling my logs for a particular = program. How do I choose not to audit the access for it? </a></dt><dt>Q: <a href=3D"#id3071089"> Even running in permissive mode, I'm getting a large number of avc de= nied messages. </a></dt><dt>Q: <a href=3D"#id3071133"> I get a specific permission denial only when SELinux is in enforcing = mode, but I don't see any audit messages in /var/log/messages (or /var/log/= audit/audit.log if using the audit daemon). How can I identify the cause of= these silent denials? </a></dt><dt>Q: <a href=3D"#id3071241"> Why do I not see the output when I run certain daemons in debug or in= teractive mode? </a></dt><dt>Q: <a href=3D"#id3071332"> When I do an upgrade of the policy package (for example, using yum), = what happens with the policy? Is it updated automatically? </a></dt><dt>Q: <a href=3D"#id3071420"> If the policy shipping with an application package changes in a way t= hat requires relabeling, will RPM handle relabeling the files owned by the = package? </a></dt><dt>Q: <a href=3D"#id3071498"> Why do binary policies distributed with Fedora, such as /etc/selinux/= <policyname>/policy/policy.<version>, and those I compile mysel= f have different sizes and MD5 checksums? </a></dt><dt>Q: <a href=3D"#id3071561"> Will new policy packages disable my system? </a></dt><dt>Q: <a href=3D"#id3071597"> My console is being flooded with messages. How do I turn them off? </a></dt><dt>Q: <a href=3D"#id3071628"> Can I test the default policy without installing the policy source? </a></dt><dt>Q: <a href=3D"#id3071712"> Why are some of my KDE applications having trouble under SELinux? </a></dt><dt>Q: <a href=3D"#id3071784"> Why does SELINUX=3Ddisabled not work for me? </a></dt><dt>Q: <a href=3D"#faq-entry-unconfined_t"> I have a process running as unconfined_t, and SELinux is still preven= ting my application from running. </a></dt><dt>Q: <a href=3D"#id3071992"> What do these rpm errors mean? </a></dt><dt>Q: <a href=3D"#id3072060"> I want to run a daemon on a non standard port but SELinux will not al= low me. How do get this to work? </a></dt><dt>Q: <a href=3D"#id3072095"> I am writing a php script that needs to create files and possibly exe= cute them. SELinux policy is preventing this. What should I do? </a></dt><dt>Q: <a href=3D"#id3072149"> I am setting up swapping to a file, but I am seeing AVC messages in m= y log files? </a></dt><dt>Q: <a href=3D"#id3072186"> Please explain the relabelto/relabelfrom permissions? </a></dt></dl></div><div class=3D"qandadiv"><div class=3D"qandaentry">= <div class=3D"question" id=3D"id3070551"><label>Q:</label><div class=3D"dat= a"><div class=3D"para"> Where are SELinux AVC messages (denial logs, etc.) stored? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> In Fedora 2 and 3, SELinux AVC messages could be found in <code class= =3D"filename">/var/log/messages</code>. In Fedora 4, the audit daemon was a= dded, and these messages moved to <code class=3D"filename">/var/log/audit/a= udit.log</code>. In Fedora 5, the audit daemon is not installed by default,= and consequently these messages can be found in <code class=3D"filename">/= var/log/messages</code> unless you choose to install and enable the audit d= aemon, in which case AVC messages will be in <code class=3D"filename">/var/= log/audit/audit.log</code>. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070593"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> My application isn't working as expected and I am seeing <code class= =3D"computeroutput">avc: denied</code> messages. How do I fix this? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> This message means that the current SELinux policy is not allowing th= e application to do something. There are a number of reasons this could hap= pen. </div><div class=3D"para"> First, one of the files the application is trying to access could be = mislabeled. If the AVC message refers to a specific file, inspect its curre= nt label with <code class=3D"command">ls -alZ <em class=3D"replaceable"><co= de>/path/to/file</code></em></code>. If it seems wrong, use the command <co= de class=3D"command">restorecon -v <em class=3D"replaceable"><code>/path/to= /file</code></em></code> to restore the file's default context. If you have= a large number of denials related to files, you may want to use <code clas= s=3D"command">fixfiles relabel</code>, or run <code class=3D"command">resto= recon -R <em class=3D"replaceable"><code>/path</code></em></code> to recurs= ively relabel a directory path. </div><div class=3D"para"> Denials are sometimes due to a configuration change in the program th= at triggered the denial message. For example, if you change Apache to also = listen on port 8800, you must also change the security policy, <code class= =3D"filename">apache.te</code>. </div><div class=3D"para"> If you are having trouble getting a specific application like Apache = to work, refer to <a class=3D"xref" href=3D"#qa-using-s-c-securitylevel" ti= tle=3D"Q:">How to use system-config-selinux</a> for information on disablin= g enforcement just for that application. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070681"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> I installed Fedora on a system with an existing <code class=3D"filena= me">/home</code> partition, and now I can't log in. </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Your <code class=3D"filename">/home</code> partition is not labeled c= orrectly. You can easily fix this two different ways. </div><div class=3D"para"> If you just want to relabel <code class=3D"filename">/home</code> rec= ursively: </div><pre class=3D"screen"> <code class=3D"command">/sbin/restorecon -v -R /home</code> </pre><div class=3D"para"> If you want to be sure there are no other files incorrectly labeled, = you can relabel the entire file system: </div><pre class=3D"screen"> <code class=3D"command">/sbin/fixfiles relabel</code> </pre><div class=3D"para"> You must have the <code class=3D"filename">policycoreutils</code> pac= kage installed to use <code class=3D"command">fixfiles</code>. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070768"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> After relabeling my <code class=3D"filename">/home</code> using <code= class=3D"command">setfiles</code> or <code class=3D"command">fixfiles</cod= e>, am I still be able to read <code class=3D"filename">/home</code> with a= non-SELinux-enabled system? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You can read the files from a non-SELinux distribution, or one with S= ELinux disabled. However, files created by a system not using SELinux syste= ms do not have a security context, nor do any files you remove and recreate= . This could be a challenge with files such as <code class=3D"filename">~/.= bashrc</code>. You may have to relabel <code class=3D"filename">/home</code= > when you reboot the SELinux enabled Fedora system. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070818"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How do I share directories using NFS between Fedora and non-SELinux s= ystems? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Just as NFS transparently supports many file system types, it can be = used to share directories between SELinux and non-SELinux systems. </div><div class=3D"para"> When you mount a non-SELinux file system via NFS, by default SELinux = treats all the files in the share as having a context of <code class=3D"com= puteroutput">nfs_t</code>. You can override the default context by setting = it manually, using the <code class=3D"option">context=3D</code> option. The= following command makes the files in the NFS mounted directory appear to h= ave a context of <code class=3D"computeroutput">system_u:object_r:tmp_t</co= de> to SELinux: </div><pre class=3D"screen"> <code class=3D"command">mount -t nfs -o context=3Dsystem_u:object_r:tmp_t s= erver:/shared/foo /mnt/foo</code> </pre><div class=3D"para"> When SELinux exports a file system via NFS, newly created files have = the context of the directory they were created in. In other words, the pres= ence of SELinux on the remote mounting system has no effect on the local se= curity contexts. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070880"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How can I create a new Linux user account with the user's home </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You can create your new user with the standard <code class=3D"command= ">useradd</code> command. First you must become <code class=3D"systemitem">= root</code>. </div><div class=3D"para"> For the targeted policy: </div><pre class=3D"screen"> <strong class=3D"userinput"><code>su - root id -Z</code></strong> <code class=3D"computeroutput">root:system_r:unconfined_t</code> <strong class=3D"userinput"><code>useradd auser ls -Z /home</code></strong> <code class=3D"computeroutput">drwx------ auser auser root:object_r:user_ho= me_dir_t /home/auser</code> </pre><div class=3D"para"> The initial context for a new user directory has an identity of <code= class=3D"computeroutput">root</code>. Subsequent relabeling of the file sy= stem changes the identity to <code class=3D"computeroutput">system_u</code>= . These are functionally the same since the role and type are identical (<c= ode class=3D"computeroutput">object_r:user_home_dir_t</code>.) </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3070962"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> Does the <code class=3D"command">su</code> command change my SELinux = identity and role? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> In previous versions of Fedora, security context transitions were int= egrated into the <code class=3D"command">su</code> via <code class=3D"compu= teroutput">pam_selinux</code>. This turned out to be more trouble than it w= as worth, and is quite unnecessary on a system running targeted policy. So,= this is no longer the case. Now, <code class=3D"command">su</code>/<code c= lass=3D"command">sudo</code> only change the Linux identy. You will need to= use <code class=3D"command">newrole</code> to change the SELinux identity,= role, or level. </div><div class=3D"para"> Other forms of Linux/<span class=3D"trademark">UNIX</span>=C2=AE iden= tity change, for example <code class=3D"command">setuid(2)</code>, also do = not cause an SELinux identity change. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071028"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> I'm having troubles with <code class=3D"command">avc</code> errors fi= lling my logs for a particular program. How do I choose not to audit the ac= cess for it? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> If you wanted to not audit <code class=3D"command">dmesg</code>, for = example, you would put this in your <code class=3D"filename">dmesg.te</code= > file: </div><pre class=3D"screen"> <strong class=3D"userinput"><code>dontaudit dmesg_t userdomain:fd { use };<= /code></strong> </pre><div class=3D"para"> This eliminates the error output to the terminal for all user domains= , including <code class=3D"varname">user</code>, <code class=3D"varname">st= aff</code> and <code class=3D"varname">sysadm</code>. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071089"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> Even running in permissive mode, I'm getting a large number of <code = class=3D"computeroutput">avc denied</code> messages. </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> In a non-enforcing mode, you should actually receive <span class=3D"e= mphasis"><em>more</em></span> messages than in enforcing mode. The kernel l= ogs each access denial as if you were in an enforcing mode. Since you are n= ot restricted by policy enforcement, you can perform more actions, which re= sults in more denials being logged. </div><div class=3D"para"> If an application running under an enforcing mode is denied access to= read a number of files in a directory, it is stopped once at the beginning= of the action. In a non-enforcing mode, the application is not stopped fro= m traversing the directory tree, and generates a denial message for each fi= le read in the directory. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071133"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> I get a specific permission denial only when SELinux is in enforcing = mode, but I don't see any audit messages in <code class=3D"filename">/var/l= og/messages</code> (or <code class=3D"filename">/var/log/audit/audit.log</c= ode> if using the audit daemon). How can I identify the cause of these sile= nt denials? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The most common reason for a silent denial is when the policy contain= s an explicit <code class=3D"computeroutput">dontaudit</code> rule to suppr= ess audit messages. The <code class=3D"computeroutput">dontaudit</code> rul= e is often used this way when a benign denial is filling the audit logs. </div><div class=3D"para"> To look for your particular denial, enable auditing of all <code clas= s=3D"computeroutput">dontaudit</code> rules: </div><pre class=3D"screen"> <code class=3D"command">semodule -b /usr/share/selinux/targeted/enableaudit= .pp</code> </pre><div class=3D"caution"><h2>Enabled <code class=3D"computeroutput">don= taudit</code> output is verbose</h2><div class=3D"para"> Enabling auditing of all <code class=3D"computeroutput">dontaudit</co= de> rules likely produce a large amount of audit information, most of which= is irrelevant to your denial. </div><div class=3D"para"> Use this technique only if you are specifically looking for an audit = message for a denial that seems to occur silently. You want to re-enable <c= ode class=3D"computeroutput">dontaudit</code> rules as soon as possible. </div></div><div class=3D"para"> Once you have found your problem you can reset to the default mode by= executing </div><pre class=3D"screen"> <code class=3D"command">semodule -b /usr/share/selinux/targeted/base.pp</co= de> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id3071241"><label>Q:</label><div class=3D"data"><div class=3D"para"> Why do I not see the output when I run certain daemons in debug or in= teractive mode? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> SELinux intentionally disables access to the tty devices to stop daem= ons from communicating back with the controlling terminal. This communicati= on is a potential security hole because such daemons could insert commands = into the controlling terminal. A broken or compromised program could use th= is hole to cause serious problems. </div><div class=3D"para"> There are a few ways you can capture standard output from daemons. On= e method is to pipe the output to the cat command. </div><pre class=3D"screen"> <code class=3D"command">snmpd -v | cat</code> </pre><div class=3D"para"> When debugging a daemon, you may want to turn off the transition of t= he daemon to its specific domain. You can do this using <code class=3D"comm= and">system-config-selinux</code> or <code class=3D"command">setsebool</cod= e> on the command line. </div><div class=3D"para"> A final option is to turn off enforcing mode while debugging. Issue t= he command <code class=3D"command">setenforce 0</code> to turn off enforcin= g mode, and use the command <code class=3D"command">setenforce 1</code> to = re-enable SELinux when you are finished debugging. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071332"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> When I do an upgrade of the policy package (for example, using <code = class=3D"command">yum</code>), what happens with the policy? Is it updated = automatically? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Policy reloads itself when the package is updated. This behavior repl= aces the manual <code class=3D"command">make load</code>. </div><div class=3D"para"> In certain situations, you may need to relabel the file system. This = might occur as part of an SELinux bug fix where file contexts become invali= d, or when the policy update makes changes to the file <code class=3D"filen= ame">/etc/selinux/targeted/contexts/files/file_contexts</code>. </div><div class=3D"para"> After the file system is relabeled, a <code class=3D"command">reboot<= /code> is not required, but is useful in ensuring every process and program= is running in the proper domain. This is highly dependent on the changes i= n the updated policy. </div><div class=3D"para"> To relabel, you have several options. You may use the <code class=3D"= command">fixfiles</code> command: </div><pre class=3D"screen"> <code class=3D"command">fixfiles relabel reboot</code> </pre><div class=3D"para"> Alternately, use the <code class=3D"filename">/.autorelabel</code> me= chanism: </div><pre class=3D"screen"> <code class=3D"command">touch /.autorelabel reboot</code> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id3071420"><label>Q:</label><div class=3D"data"><div class=3D"para"> If the policy shipping with an application package changes in a way t= hat requires relabeling, will RPM handle relabeling the files owned by the = package? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Yes. The security contexts for the files owned by the package are sto= red in the header data for the package. The file contexts are set directly = after the <code class=3D"command">cpio</code> copy, as the package files ar= e being put on the disk. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071498"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> Why do binary policies distributed with Fedora, such as <code class= =3D"filename">/etc/selinux/<em class=3D"replaceable"><code><policyname&g= t;</code></em>/policy/policy.<em class=3D"replaceable"><code><version>= ;</code></em></code>, and those I compile myself have different sizes and M= D5 checksums? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> When you install a policy package, pre-compiled binary policy files a= re put directly into <code class=3D"filename">/etc/selinux</code>. The diff= erent build environments will make target files that have different sizes a= nd MD5 checksums. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071561"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> Will new policy packages disable my system? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> There is a possibility that changes in the policy package or in the p= olicy shipping with an application package can cause errors, more denials, = or other unknown behaviors. You can discover which package caused the break= age by reverting policy and application packages one at a time. If you don'= t want to return to the previous package, the older version of the configur= ation files will be saved with the extension <code class=3D"filename">.rpms= ave</code>. Use the mailing lists, bugzilla, and IRC to help you work throu= gh your problem. If you are able, write or fix policy to resolve your probl= em. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071597"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> My console is being flooded with messages. How do I turn them off? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> To regain useful control, turn off kernel messages to the console wit= h this command: </div><pre class=3D"screen"> <code class=3D"command">dmesg -n 1</code> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id3071628"><label>Q:</label><div class=3D"data"><div class=3D"para"> Can I test the default policy without installing the policy source? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You can test SELinux default policy by installing just the <code clas= s=3D"filename">selinux-policy-<em class=3D"replaceable"><code>policyname</c= ode></em></code> and <code class=3D"filename">policycoreutils</code> packag= es. Without the policy source installed, the <code class=3D"command">fixfil= es</code> command automates the file system relabeling. </div><div class=3D"para"> The command <code class=3D"command">fixfiles relabel</code> is the eq= uivalent of <code class=3D"command">make relabel</code>. During the relabel= ing, it will delete all of the files in <code class=3D"filename">/tmp</code= >, cleaning up files which may have old file context labels. </div><div class=3D"para"> Other commands are <code class=3D"command">fixfiles check</code>, whi= ch checks for mislabeled files, and <code class=3D"command">fixfiles restor= e</code>, which fixes the mislabeled files but does not delete the files in= <code class=3D"filename">/tmp</code>. The <code class=3D"command">fixfiles= </code> command does not take a list of directories as an argument, because= it relabels the entire file system. If you need to relabel a specific dire= ctory path, use <code class=3D"command">restorecon</code>. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071712"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> Why are some of my KDE applications having trouble under SELinux? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> KDE executables always appear as <code class=3D"command">kdeinit</cod= e>, which limits what can be done with SELinux policy. This is because ever= y KDE application runs in the domain for <code class=3D"command">kdeinit</c= ode>. </div><div class=3D"para"> Problems often arise when installing SELinux because it is not possib= le to relabel <code class=3D"filename">/tmp</code> and <code class=3D"filen= ame">/var/tmp</code>. There is no good method of determining which file sho= uld have which context. </div><div class=3D"para"> The solution is to fully log out of KDE and remove all KDE temporary = files: </div><pre class=3D"screen"> <code class=3D"command">rm -rf /var/tmp/kdecache-<em class=3D"replaceable">= <code><username></code></em> rm -rf /var/tmp/<em class=3D"replaceable= "><code><other_kde_files></code></em></code> </pre><div class=3D"para"> At your next login, your problem should be fixed. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3071784"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> Why does <code class=3D"option">SELINUX=3Ddisabled</code> not work fo= r me? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Be careful of white space in the file <code class=3D"filename">/etc/s= ysconfig/selinux</code>. The code is very sensitive to white space, even tr= ailing space. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"faq-entry-unconfined_t"><label>Q:</label><div class=3D"data"><div= class=3D"para"> I have a process running as <code class=3D"computeroutput">unconfined= _t</code>, and SELinux is still preventing my application from running. </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> We have begun to confine the <code class=3D"computeroutput">unconfine= d_t</code> domain somewhat. SELinux restricts certain memory protection ope= ration. Following is a list of those denials, as well as possible reasons a= nd solutions for those denials. For more information on these restrictions,= see <a href=3D"http://people.redhat.com/drepper/selinux-mem.html">http://p= eople.redhat.com/drepper/selinux-mem.html</a>. </div><div class=3D"para"> These show up in <code class=3D"filename">/var/log/messages</code> (o= r <code class=3D"filename">/var/log/audit/audit.log</code> if using the aud= it daemon) as avc denials. These can also show up when running programs wit= h errors like </div><pre class=3D"screen"> error while loading shared libraries: /usr/lib/libavutil.so.49: cannot restore segment prot after reloc: Permission denied </pre><div class=3D"para"> which indicates that the library is trying to perform a text relocati= on and failing. Text relocations are bad, but can be allowed via the first = hint below. Below are the SELinux memory permissions that are denied, as we= ll as hints at how to address these denials. </div><div class=3D"variablelist"><dl><dt><span class=3D"term"><code c= lass=3D"computeroutput">execmod</code></span></dt><dd><div class=3D"para"> This is usually based on a library label. You can permanently chan= ge the context on the library with the following commands </div><pre class=3D"screen"> # /usr/sbin/semanage fcontext -a -t textrel_shlib_t '/usr/lib/libavutil.so.= 49.0.0' # /sbin/restorecon -v /usr/lib/libavutil.so.49.0.0 </pre><div class=3D"para"> with the particular library at fault in place of <code class=3D"fi= lename">/usr/lib/libavutil.so.49.0.0</code>. Now your application should be= able to run. Please report this as a bugzilla. </div></dd><dt><span class=3D"term"><code class=3D"computeroutput">= execstack</code></span></dt><dd><div class=3D"para"> Attempt to <code class=3D"command">execstack -c <em class=3D"repla= ceable"><code>LIBRARY</code></em></code>. Now try your application again. I= f the application now works, the library was mistakenly marked as requiring= <code class=3D"computeroutput">execstack</code>. Please report this as a b= ugzilla. </div></dd><dt><span class=3D"term"><code class=3D"computeroutput">= execmem, execheap</code></span></dt><dd><div class=3D"para"> A boolean for each one of these memory check errors have been prov= ided. So if you need to run an application requiring either of these permis= sions, you can set the boolean allow_exec* to fix the problem. For instance= if you try to run an application and you get an AVC message containing an = <code class=3D"computeroutput">execstack</code> failure. You can set the bo= olean with </div><pre class=3D"screen"> <code class=3D"command">setsebool -P allow_execstack=3D1</code> </pre></dd></dl></div></div></div></div><div class=3D"qandaentry"><div clas= s=3D"question" id=3D"id3071992"><label>Q:</label><div class=3D"data"><div c= lass=3D"para"> What do these rpm errors mean? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><pre class=3D"screen"> restorecon reset /etc/modprobe.conf context system_u:object_r:etc_runtime_t= ->system_u:object_r:modules_conf_t restorecon reset /etc/cups/ppd/homehp.ppd context user_u:object_r:cupsd_etc= _t->system_u:object_r:cupsd_rw_etc_t </pre><div class=3D"para"> During the update process, the selinux package runs restorecon on the= difference between the previously install policy file_context and the newl= y install policy context. This maintains the correct file context on disk. </div><pre class=3D"screen"> <code class=3D"computeroutput">libsepol.sepol_genbools_array: boolean hidd_= disable_trans no longer in policy</code> </pre><div class=3D"para"> This indicates that the updated policy has removed the boolean from p= olicy. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3072060"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> I want to run a daemon on a non standard port but SELinux will not al= low me. How do get this to work? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You can use the <code class=3D"command">semanage</code> command to de= fine additional ports. So say you want httpd to be able to listen on port 8= 082. You could enter the command. </div><pre class=3D"screen"> <code class=3D"command">semanage port -a -p tcp -t http_port_t 8082</code> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id3072095"><label>Q:</label><div class=3D"data"><div class=3D"para"> I am writing a php script that needs to create files and possibly exe= cute them. SELinux policy is preventing this. What should I do? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> First, you should never allow a system service to execute anything it= can write. This gives an attacker the ability to upload malicious code to = the server and then execute it, which is something we want to prevent. </div><div class=3D"para"> If you merely need to allow your script to create (non-executable) fi= les, this is possible. That said, you should avoid having system applicatio= ns writing to the <code class=3D"filename">/tmp</code> directory, since use= rs tend to use the <code class=3D"filename">/tmp</code> directory also. It = would be better to create a directory elsewhere which could be owned by the= apache process and allow your script to write to it. You should label the = directory <code class=3D"computeroutput">httpd_sys_script_rw_t</code>, whic= h will allow apache to read and write files to that directory. This directo= ry could be located anywhere that apache can get to (even <code class=3D"fi= lename">$HOME/public_html/</code>). </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3072149"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> I am setting up swapping to a file, but I am seeing AVC messages in m= y log files? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> You need to identify the swapfile to SELinux by setting its file cont= ext to <code class=3D"computeroutput">swapfile_t</code>. </div><pre class=3D"screen"> <code class=3D"command">chcon -t swapfile_t <em class=3D"replaceable"><code= >SWAPFILE</code></em></code> </pre></div></div></div><div class=3D"qandaentry"><div class=3D"question" i= d=3D"id3072186"><label>Q:</label><div class=3D"data"><div class=3D"para"> Please explain the <code class=3D"computeroutput">relabelto</code>/<c= ode class=3D"computeroutput">relabelfrom</code> permissions? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> For files, <code class=3D"computeroutput">relabelfrom</code> means "C= an domain D relabel a file from (i.e. currently in) type T1?" and <code cla= ss=3D"computeroutput">relabelto</code> means "Can domain D relabel a file t= o type T2?", so both checks are applied upon a file relabeling, where T1 is= the original type of the type and T2 is the new type specified by the prog= ram. </div><div class=3D"para"> Useful documents to look at: </div><div class=3D"itemizedlist"><ul><li class=3D"listitem"><div clas= s=3D"para"> Object class and permission summary by Tresys <a href=3D"http://tre= sys.com/selinux/obj_perms_help.shtml">http://tresys.com/selinux/obj_perms_h= elp.shtml</a> </div></li><li class=3D"listitem"><div class=3D"para"> Implementing SELinux as an LSM technical report (describes permissi= on checks on a per-hook basis) <a href=3D"http://www.nsa.gov/selinux/papers= /module-abs.cfm">http://www.nsa.gov/selinux/papers/module-abs.cfm</a>. This= is also available in the selinux-doc package (and more up-to-date there). </div></li><li class=3D"listitem"><div class=3D"para"> Integrating Flexible Support for Security Policies into the Linux O= perating System - technical report (describes original design and implement= ation, including summary tables of classes, permissions, and what permissio= n checks are applied to what system calls. It is not entirely up-to-date wi= th current implementation, but a good resource nonetheless). <a href=3D"htt= p://www.nsa.gov/selinux/papers/slinux-abs.cfm">http://www.nsa.gov/selinux/p= apers/slinux-abs.cfm</a> </div></li></ul></div></div></div></div></div><div class=3D"qandadiv= "><h4 class=3D"title" id=3D"faq-div-deploying-selinux">1.4. Deploying SELin= ux</h4></div><div class=3D"toc"><dl><dt>Q: <a href=3D"#id3072295"> What file systems can I use for SELinux? </a></dt><dt>Q: <a href=3D"#id3072333"> How does SELinux impact system performance? </a></dt><dt>Q: <a href=3D"#id3072362"> What types of deployments, applications, and systems should I leverag= e SELinux in? </a></dt><dt>Q: <a href=3D"#id3072425"> How does SELinux affect third-party applications? </a></dt></dl></div><div class=3D"qandadiv"><div class=3D"qandaentry">= <div class=3D"question" id=3D"id3072295"><label>Q:</label><div class=3D"dat= a"><div class=3D"para"> What file systems can I use for SELinux? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> The file system must support <code class=3D"computeroutput">xattr</co= de> labels in the right <em class=3D"parameter"><code>security.*</code></em= > namespace. In addition to ext2/ext3, XFS has recently added support for t= he necessary labels. </div><div class=3D"para"> Note that XFS SELinux support is broken in upstream kernel 2.6.14 and= 2.6.15, but fixed (worked around) in 2.6.16. Your kernel must include this= fix if you choose to use XFS with SELinux. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3072333"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How does SELinux impact system performance? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> This is a variable that is hard to measure, and is heavily dependent = on the tuning and usage of the system running SELinux. When performance was= last measured, the impact was around 7% for completely untuned code. Subse= quent changes in system components such as networking are likely to have ma= de that worse in some cases. SELinux performance tuning continues to be a p= riority of the development team. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3072362"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> What types of deployments, applications, and systems should I leverag= e SELinux in? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> Initially, SELinux has been used on Internet facing servers that are = performing a few specialized functions, where it is critical to keep extrem= ely tight security. Administrators typically strip such a box of all extra = software and services, and run a very small, focused set of services. A Web= server or mail server is a good example. </div><div class=3D"para"> In these edge servers, you can lock down the policy very tightly. The= smaller number of interactions with other components makes such a lock dow= n easier. A dedicated system running a specialized third-party application = would also be a good candidate. </div><div class=3D"para"> In the future, SELinux will be targeted at all environments. In order= to achieve this goal, the community and <em class=3D"firstterm">independen= t software vendors</em> (<abbr class=3D"abbrev">ISV</abbr>s) must work with= the SELinux developers to produce the necessary policy. </div><div class=3D"para"> For more information about these policies, refer to <a class=3D"xref"= href=3D"#qa-whatis-policy" title=3D"Q:">What is SELinux policy?</a>. </div></div></div></div><div class=3D"qandaentry"><div class=3D"questi= on" id=3D"id3072425"><label>Q:</label><div class=3D"data"><div class=3D"par= a"> How does SELinux affect third-party applications? </div></div></div><div class=3D"answer"><label>A:</label><div class=3D= "data"><div class=3D"para"> One goal of implementing a targeted SELinux policy in Fedora is to al= low third-party applications to work without modification. The targeted pol= icy is transparent to those unaddressed applications, and it falls back on = standard Linux DAC security. These applications, however, will not be runni= ng in an extra-secure manner. You or another provider must write policy to = protect these applications with MAC security. </div><div class=3D"para"> It is impossible to predict how every third-party application might b= ehave with SELinux, even running the targeted policy. You may be able to fi= x issues that arise by changing the policy. You may find that SELinux expos= es previously unknown security issues with your application. You may have t= o modify the application to work under SELinux. </div><div class=3D"para"> Note that with the addition of <a class=3D"xref" href=3D"#faq-entry-w= hatare-policy-modules" title=3D"Q:">Policy Modules</a>, it is now possible = for third-party developers to include policy modules with their application= . If you are a third-party developer or a package-maintainer, please consid= er including a policy module in your package. This will allow you to secure= the behavior of your application with the power of SELinux for any user in= stalling your package. </div><div class=3D"para"> One important value that Fedora testers and users bring to the commun= ity is extensive testing of third-party applications. With that in mind, pl= ease bring your experiences to the appropriate mailing list, such as the fe= dora-selinux list, for discussion. For more information about that list, re= fer to <a href=3D"http://www.redhat.com/mailman/listinfo/fedora-selinux-lis= t/">http://www.redhat.com/mailman/listinfo/fedora-selinux-list/</a>. </div></div></div></div></div></div></div></div></div></body></html> --===============5267014355845312144==--