Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24364
Added Files:
index.html
Log Message:
--- NEW FILE index.html ---
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>SELinux FAQ</title><link rel="stylesheet"
href="./Common_Content/css/default.css" type="text/css" /><meta
name="generator" content="publican 1.3" /><meta
name="package" content="Fedora-SELinux_FAQ-12-en-US-0-0" /><meta
name="description" content="This FAQ answers many questions about
Security-Enhanced Linux. The information in this FAQ is valuable for those who are new to
SELinux." /></head><body class=""><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><div xml:lang="en-US" class="article"
title="SELinux FAQ" lang="en-US"><div
class="titlepage"><div><div
class="producttitle"><span
class="productname">Fedora</span> <span class="p
roductnumber">12</span></div><div><h1
id="chap-SELinux-FAQ-FAQ" class="title">SELinux
FAQ</h1></div><div><h2 class="subtitle">Frequently-asked
questions about Security Enhanced Linux</h2></div><div><h3
class="corpauthor">
<span class="inlinemediaobject"><object
data="Common_Content/images/title_logo.svg" type="image/svg+xml">
</object></span>
</h3></div><div><div xml:lang="en-US"
class="authorgroup" lang="en-US"><div
class="author"><h3 class="author"><span
class="firstname">Karsten</span> <span
class="surname">Wade</span></h3><div
class="affiliation"><span class="orgname">Fedora</span>
<span class="orgdiv">Documentation
Project</span></div><code class="email"><a
class="email"
href="mailto:quaid@fedoraproject.org">quaid@fedoraproject.org</a></code></div><div
class="author"><h3 class="author"><span
class="firstname">Paul W.</span> <span
class="surname">Frields</span></h3><div
class="affiliation"><span class="orgname">Fedora</span>
<span class="orgdiv">Documentation
Project</span></div><code class="email"><a
class="email"
href="mailto:pfrields@fedoraproject.org">pfrields@fedoraproject.org</a></code></div><div
class="author"><h3 class="author"><span
class="firstname">Scott</span> <span
class="surname">Radvan</span></h3><div
class="affiliation"><span class="orgname">Red
Hat</span> <span class="orgdiv">Engineering Cont
ent Services</span></div><code class="email"><a
class="email"
href="mailto:sradvan@redhat.com">sradvan@redhat.com</a></code></div></div></div><div><div
id="id3043795" class="legalnotice"><h1
class="legalnotice">Legal Notice</h1><div
class="para">
Copyright <span class="trademark"></span>© 2010 Red Hat, Inc..
</div><div class="para">
The text of and illustrations in this document are licensed by Red Hat under a Creative
Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An
explanation of CC-BY-SA is available at <a
href="http://creativecommons.org/licenses/by-sa/3.0/">http:/...;.
The original authors of this document, and Red Hat, designate the Fedora Project as the
"Attribution Party" for purposes of CC-BY-SA. In accordance with CC-BY-SA, if
you distribute this document or an adaptation of it, you must provide the URL for the
original version.
</div><div class="para">
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not
to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
</div><div class="para">
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the
Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States
and other countries.
</div><div class="para">
For guidelines on the permitted uses of the Fedora trademarks, refer to <a
href="https://fedoraproject.org/wiki/Legal:Trademark_guidelines"...;.
</div><div class="para">
<span class="trademark">Linux</span>® is the registered trademark
of Linus Torvalds in the United States and other countries.
</div><div class="para">
All other trademarks are the property of their respective owners.
</div></div></div><div><div class="abstract"
title="Abstract"><h6>Abstract</h6><div
class="para">
This FAQ answers many questions about Security-Enhanced Linux. The
information in this FAQ is valuable for those who are new to SELinux.
</div></div></div></div><hr /></div><div
class="toc"><dl><dt><span class="section"><a
href="#SELinux_FAQ-FAQ-SELinux">1.
SELinux</a></span></dt></dl></div><div
class="para">
For more information about how SELinux works, how to use SELinux for general and
specific Linux distributions, and how to write policy, these resources are useful:
</div><div class="itemizedlist"><h6>External Link
List</h6><ul><li class="listitem"><div
class="para">
NSA SELinux main website — <a
href="http://www.nsa.gov/selinux/">http://www.nsa.gov/selinu...
</div></li><li class="listitem"><div
class="para">
NSA SELinux FAQ — <a
href="http://www.nsa.gov/selinux/info/faq.cfm">http://www.ns...
</div></li><li class="listitem"><div
class="para">
SELinux community page — <a
href="http://selinux.sourceforge.net">http://selinux.sourceforge.net</a>
</div></li><li class="listitem"><div
class="para">
UnOfficial FAQ — <a
href="http://www.crypt.gen.nz/selinux/faq.html">http://www.crypt.gen.nz/selinux/faq.html</a>
</div></li><li class="listitem"><div
class="para">
Writing traditional SE Linux policy HOWTO — <a
href="https://sourceforge.net/docman/display_doc.php?docid=21959&...
</div></li><li class="listitem"><div
class="para">
Reference Policy (the new policy found in Fedora 5) — <a
href="http://serefpolicy.sourceforge.net/">http://serefpolic...
</div></li><li class="listitem"><div
class="para">
SELinux policy development training courses — <a
href="http://tresys.com/services/training.shtml">http://tres...
and <a
href="https://www.redhat.com/training/security/courses/rhs429.html&q...
</div></li><li class="listitem"><div
class="para">
Getting Started with SE Linux HOWTO: the new SELinux (Debian) — <a
href="https://sourceforge.net/docman/display_doc.php?docid=20372&...
</div></li><li class="listitem"><div
class="para">
List of SELinux object classes and permissions — <a
href="http://tresys.com/selinux/obj_perms_help.shtml">http:/...
</div></li><li class="listitem"><div
class="para">
On IRC -
irc.freenode.net, #fedora-selinux
</div></li><li class="listitem"><div
class="para">
Fedora mailing list — <a
href="mailto:fedora-selinux-list@redhat.com">mailto:fedora-selinux-list@redhat.com</a>;
read the archives or subscribe at <a
href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list&quo...
</div></li></ul></div><div class="section"
title="1. SELinux"><div
class="titlepage"><div><div><h2 class="title"
id="SELinux_FAQ-FAQ-SELinux">1. SELinux</h2></div></div></div><div
class="qandaset" title="Frequently Asked Questions"
id="id2913416"><dl><dt></dt><dd><dl><dt>Q:
<a href="#id2913421">
What is SELinux?
</a></dt><dt>Q: <a href="#id2914799">
What is SELinux policy?
</a></dt><dt>Q: <a href="#id3057481">
What happened to the strict policy?
</a></dt><dt>Q: <a href="#id2898184">
What programs are protected by the SELinux policy?
</a></dt><dt>Q: <a
href="#faq-entry-whatis-refpolicy">
What is the Reference Policy?
</a></dt><dt>Q: <a href="#id2898287">
What are file contexts?
</a></dt><dt>Q: <a href="#id2916596">
How do I view the security context of a file, user, or process?
</a></dt><dt>Q: <a href="#id2916634">
What is the difference between a domain and a type?
</a></dt><dt>Q: <a
href="#faq-entry-whatare-policy-modules">
What are policy modules?
</a></dt><dt>Q: <a
href="#faq-entry-whatis-managed-policy">
What is managed policy?
</a></dt></dl></dd><dt>1.2. <a
href="#id2929042">Controlling
SELinux</a></dt><dd><dl><dt>Q: <a
href="#id2929048">
How do I install/not install SELinux?
</a></dt><dt>Q: <a href="#id2929075">
As an administrator, what do I need to do to configure SELinux for my system?
</a></dt><dt>Q: <a
href="#qa-using-s-c-securitylevel">
How do I enable/disable SELinux protection on specific daemons under the targeted
policy?
</a></dt><dt>Q: <a href="#faq-entry-local.te">
In the past I have written local.te file in policy sources for my own local
customization to policy, how do I do this in Fedora 5?
</a></dt><dt>Q: <a href="#id2929497">
I have some avc denials that I would like to allow, how do I do this?
</a></dt><dt>Q: <a href="#id2929670">
How can I help write policy?
</a></dt><dt>Q: <a href="#id3069707">
How do I switch the policy I am currently using?
</a></dt><dt>Q: <a href="#id3069893">
How can I back up files from an SELinux file system?
</a></dt><dt>Q: <a href="#faq-entry-public_html">
How do I make a user public_html directory work under SELinux?
</a></dt><dt>Q: <a href="#id3070107">
How do I turn SELinux off at boot?
</a></dt><dt>Q: <a href="#id3070170">
How do I turn enforcing on/off at boot?
</a></dt><dt>Q: <a href="#id3070271">
How do I temporarily turn off enforcing mode without having to reboot?
</a></dt><dt>Q: <a href="#id3070304">
How do I turn system call auditing on/off at boot?
</a></dt><dt>Q: <a href="#id3070350">
How do I temporarily turn off system-call auditing without having to reboot?
</a></dt><dt>Q: <a href="#id3070377">
How do I get status info about my SELinux installation?
</a></dt><dt>Q: <a href="#id3070407">
How do I write policy to allow a domain to use pam_unix.so?
</a></dt><dt>Q: <a href="#id3070489">
I created a new Policy Package, where do I put it to make sure that it gets loaded
into the kernel?
</a></dt></dl></dd><dt>1.3. <a
href="#faq-div-resolving-problems">Resolving
Problems</a></dt><dd><dl><dt>Q: <a
href="#id3070551">
Where are SELinux AVC messages (denial logs, etc.) stored?
</a></dt><dt>Q: <a href="#id3070593">
My application isn't working as expected and I am seeing avc: denied messages.
How do I fix this?
</a></dt><dt>Q: <a href="#id3070681">
I installed Fedora on a system with an existing /home partition, and now I can't
log in.
</a></dt><dt>Q: <a href="#id3070768">
After relabeling my /home using setfiles or fixfiles, am I still be able to read
/home with a non-SELinux-enabled system?
</a></dt><dt>Q: <a href="#id3070818">
How do I share directories using NFS between Fedora and non-SELinux systems?
</a></dt><dt>Q: <a href="#id3070880">
How can I create a new Linux user account with the user's home
</a></dt><dt>Q: <a href="#id3070962">
Does the su command change my SELinux identity and role?
</a></dt><dt>Q: <a href="#id3071028">
I'm having troubles with avc errors filling my logs for a particular program.
How do I choose not to audit the access for it?
</a></dt><dt>Q: <a href="#id3071089">
Even running in permissive mode, I'm getting a large number of avc denied
messages.
</a></dt><dt>Q: <a href="#id3071133">
I get a specific permission denial only when SELinux is in enforcing mode, but I
don't see any audit messages in /var/log/messages (or /var/log/audit/audit.log if
using the audit daemon). How can I identify the cause of these silent denials?
</a></dt><dt>Q: <a href="#id3071241">
Why do I not see the output when I run certain daemons in debug or interactive
mode?
</a></dt><dt>Q: <a href="#id3071332">
When I do an upgrade of the policy package (for example, using yum), what happens
with the policy? Is it updated automatically?
</a></dt><dt>Q: <a href="#id3071420">
If the policy shipping with an application package changes in a way that requires
relabeling, will RPM handle relabeling the files owned by the package?
</a></dt><dt>Q: <a href="#id3071498">
Why do binary policies distributed with Fedora, such as
/etc/selinux/<policyname>/policy/policy.<version>, and those I
compile myself have different sizes and MD5 checksums?
</a></dt><dt>Q: <a href="#id3071561">
Will new policy packages disable my system?
</a></dt><dt>Q: <a href="#id3071597">
My console is being flooded with messages. How do I turn them off?
</a></dt><dt>Q: <a href="#id3071628">
Can I test the default policy without installing the policy source?
</a></dt><dt>Q: <a href="#id3071712">
Why are some of my KDE applications having trouble under SELinux?
</a></dt><dt>Q: <a href="#id3071784">
Why does SELINUX=disabled not work for me?
</a></dt><dt>Q: <a href="#faq-entry-unconfined_t">
I have a process running as unconfined_t, and SELinux is still preventing my
application from running.
</a></dt><dt>Q: <a href="#id3071992">
What do these rpm errors mean?
</a></dt><dt>Q: <a href="#id3072060">
I want to run a daemon on a non standard port but SELinux will not allow me. How do
get this to work?
</a></dt><dt>Q: <a href="#id3072095">
I am writing a php script that needs to create files and possibly execute them.
SELinux policy is preventing this. What should I do?
</a></dt><dt>Q: <a href="#id3072149">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</a></dt><dt>Q: <a href="#id3072186">
Please explain the relabelto/relabelfrom permissions?
</a></dt></dl></dd><dt>1.4. <a
href="#faq-div-deploying-selinux">Deploying
SELinux</a></dt><dd><dl><dt>Q: <a
href="#id3072295">
What file systems can I use for SELinux?
</a></dt><dt>Q: <a href="#id3072333">
How does SELinux impact system performance?
</a></dt><dt>Q: <a href="#id3072362">
What types of deployments, applications, and systems should I leverage SELinux in?
</a></dt><dt>Q: <a href="#id3072425">
How does SELinux affect third-party applications?
</a></dt></dl></dd></dl><div
class="qandaset"><div class="toc"><dl><dt>Q:
<a href="#id2913421">
What is SELinux?
</a></dt><dt>Q: <a href="#id2914799">
What is SELinux policy?
</a></dt><dt>Q: <a href="#id3057481">
What happened to the strict policy?
</a></dt><dt>Q: <a href="#id2898184">
What programs are protected by the SELinux policy?
</a></dt><dt>Q: <a
href="#faq-entry-whatis-refpolicy">
What is the Reference Policy?
</a></dt><dt>Q: <a href="#id2898287">
What are file contexts?
</a></dt><dt>Q: <a href="#id2916596">
How do I view the security context of a file, user, or process?
</a></dt><dt>Q: <a href="#id2916634">
What is the difference between a domain and a type?
</a></dt><dt>Q: <a
href="#faq-entry-whatare-policy-modules">
What are policy modules?
</a></dt><dt>Q: <a
href="#faq-entry-whatis-managed-policy">
What is managed policy?
</a></dt></dl></div><div
class="qandadiv"><div class="qandaentry"><div
class="question"
id="id2913421"><label>Q:</label><div
class="data"><div class="para">
What is SELinux?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
SELinux (<em class="firstterm">Security-Enhanced Linux</em>)
in Fedora is an implementation of <em class="firstterm">mandatory access
control</em> in the Linux kernel using the <em
class="firstterm">Linux Security Modules</em> (<abbr
class="abbrev">LSM</abbr>) framework. Standard Linux security is a
<em class="firstterm">discretionary access control</em> model.
</div><div class="variablelist"><dl><dt><span
class="term">Discretionary access control (<abbr
class="abbrev">DAC</abbr>)</span></dt><dd><div
class="para">
DAC is standard Linux security, and it provides no protection from broken
software or malware running as a normal user or root. Users can grant risky levels of
access to files they own.
</div></dd><dt><span class="term">Mandatory
access control (<abbr
class="abbrev">MAC</abbr>)</span></dt><dd><div
class="para">
MAC provides full control over all interactions of software. Administratively
defined policy closely controls user and process interactions with the system, and can
provide protection from broken software or malware running as any user.
</div></dd></dl></div><div class="para">
In a DAC model, file and resource decisions are based solely on user identity and
ownership of the objects. Each user and program run by that user has complete discretion
over the user's objects. Malicious or flawed software can do anything with the files
and resources it controls through the user that started the process. If the user is the
super-user or the application is <code class="command">setuid</code>
or <code class="command">setgid</code> to root, the process can have
root level control over the entire file system.
</div><div class="para">
A MAC system does not suffer from these problems. First, you can administratively
define a security policy over all processes and objects. Second, you control all processes
and objects, in the case of SELinux through the kernel. Third, decisions are based on all
the security relevant information available, and not just authenticated user identity.
</div><div class="para">
MAC under SELinux allows you to provide granular permissions for all <em
class="firstterm">subjects</em> (users, programs, processes) and <em
class="firstterm">objects</em> (files, devices). In practice, think of
subjects as processes, and objects as the target of a process operation. You can safely
grant a process only the permissions it needs to perform its function, and no more.
</div><div class="para">
The SELinux implementation uses <em class="firstterm">role-based
access control</em> (<abbr class="abbrev">RBAC</abbr>), which
provides abstracted user-level control based on roles, and <em
class="firstterm"><span class="trademark">Type
Enforcement</span>®</em> (<abbr
class="abbrev">TE</abbr>). TE uses a table, or <em
class="firstterm">matrix</em> to handle access controls, enforcing
policy rules based on the types of processes and objects. Process types are called <em
class="firstterm">domains</em>, and a cross-reference on the matrix of
the process's domain and the object's type defines their interaction. This system
provides extremely granular control for actors in a Linux system.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id2914799"><label>Q:</label><div
class="data"><div class="para">
What is SELinux policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The SELinux policy describes the access permissions for all subjects and objects,
that is, the entire system of users, programs, and processes and the files and devices
they act upon. Fedora policy is delivered in a package, with an associated source package.
Current shipping policy packages are:
</div><div class="variablelist"><dl><dt><span
class="term"><code class="filename">selinux-policy-<em
class="replaceable"><code><version></code></em>.noarch.rpm</code></span></dt><dd><div
class="para">
This package is common to all types of policy and contains config files/man
pages. This includes the interface files for the development environment. This replaces
the -sources package from the past. This package contains the interface files used in
Reference Policy along with a Makefile and a small tool called <code
class="command">sepolgen</code> used to generate a policy template
file. The interface files reside in <code
class="filename">/usr/share/selinux/devel/include</code> directory. If
you want to see all of the policy files used to build the Reference Policy you need to
install the src.rpm.
</div></dd></dl></div></div></div></div><div
class="qandaentry"><div class="question"
id="id3057481"><label>Q:</label><div
class="data"><div class="para">
What happened to the strict policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Strict policy since RHEL5 and Fedora Core 5 has been the equivalent of targeted
policy with the unconfined domains removed. This means all users had to have a type
defined for them like staff_t or user_t. And all processes started by init would need to
have policy written for them. As of Fedora Core 9, the strict policy was removed and
merged into targeted policy.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id2898184"><label>Q:</label><div
class="data"><div class="para">
What programs are protected by the SELinux policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The number of programs that have SELinux policy defined for them is constantly
changing and evolving. Different versions of policy have more or less executables covered.
By convention all confined executables have a label type that ends with exec_t. The
SELinux tools package (setools) includes the seinfo application which allows you to
examine the installed policy.
<pre class="screen">
<code class="computeroutput"> # seinfo -t | grep exec_t | wc -l 572
</code>
</pre>
</div></div></div></div><div
class="qandaentry"><div class="question"
id="faq-entry-whatis-refpolicy"><label>Q:</label><div
class="data"><div class="para">
What is the Reference Policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The <em class="firstterm">Reference Policy</em> is a new
project maintained by Tresys Technology (<a
href="http://www.tresys.com/">http://www.tresys.com/</a>) designed to
rewrite the entire SELinux policy in a way that is easier to use and understand. To do
this, it uses the concepts of modularity, abstraction, and well-defined interfaces. Refer
to <a
href="http://serefpolicy.sourceforge.net/">http://serefpolic...
for more information on the Reference Policy.
</div><div class="para">
Note that Reference Policy is not a new type of policy. Rather, it is a new base
that policies can be built from.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id2898287"><label>Q:</label><div
class="data"><div class="para">
What are file contexts?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
<em class="firstterm">File contexts</em> are used by the
<code class="command">setfiles</code> command to generate persistent
labels which describe the security context for a file or directory.
</div><div class="para">
Fedora ships with the <code class="command">fixfiles</code>
script, which supports three options: <code
class="option">check</code>, <code
class="option">restore</code>, and <code
class="option">relabel</code>. This script allows users to relabel the
file system without having the <code
class="filename">selinux-policy-targeted-sources</code> package
installed. The command line usage is more friendly than the standard <code
class="command">setfiles</code> command.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id2916596"><label>Q:</label><div
class="data"><div class="para">
How do I view the security context of a file, user, or process?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The new option <code class="option">-Z</code> is the short
method for displaying the context of a subject or object:
</div><pre class="screen">
<code class="command">ls -alZ <em
class="replaceable"><code>file.foo</code></em> id -Z ps
-eZ</code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id2916634"><label>Q:</label><div
class="data"><div class="para">
What is the difference between a <em
class="firstterm">domain</em> and a <em
class="firstterm">type</em>?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
There is no difference between a domain and a type, although domain is sometimes
used to refer to the type of a process. The use of domain in this way stems from Domain
and Type Enforcement (DTE) models, where domains and types are separate.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="faq-entry-whatare-policy-modules"><label>Q:</label><div
class="data"><div class="para">
What are policy modules?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Prior to Fedora 5, SELinux policies were monolithic, meaning making a change
required getting the entire policy source, modifying it, compiling it, and replacing the
current policy with it. With Fedora 5, the policy is now modular. This means that third
party developers can ship policy modules with their applications, and then they can be
added to the policy without having to switch out the entire policy. The new module is then
added to the module store, which results in a new policy binary that is a combination of
the previous policy and the new module.
</div><div class="para">
This actually works by separating out compile and link steps in the policy build
procedure. Policy modules are compiled from source, and linked when installed into the
module store (see <a class="xref"
href="#faq-entry-whatis-managed-policy" title="Q:">Managed
Policy</a>). This linked policy is then loaded into the kernel for enforcement.
</div><div class="para">
The primary command for dealing with modules is <code
class="command">semodule</code>, which lets you perform basic functions
such as installing, upgrading, or removing modules. Other useful commands include <code
class="command">checkmodule</code>, which is the module compiler and is
installed with the checkpolicy rpm, as well as <code
class="command">semodule_package</code>, which creates a policy package
file (.pp) from a compiled policy module.
</div><div class="para">
Modules are usually stored as policy package file (.pp extension) in <code
class="filename">/usr/share/selinux/<em
class="replaceable"><code>policyname</code></em>/</code>.
There you should at least find the base.pp, which is the base module.
</div><div class="para">
To see how to write a simple policy module, check out <a class="xref"
href="#faq-entry-local.te" title="Q:">Local Policy
Customizations</a>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="faq-entry-whatis-managed-policy"><label>Q:</label><div
class="data"><div class="para">
What is managed policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Prior to Fedora 5, SELinux policies were handled as user-editable config files in
etc. Unfortunately, this made it difficult to address many of the usability issues arising
with SELinux. So, a new library, <code
class="filename">libsemanage</code>, was added to provide userspace
tools an interface to making policy management easier. All policy management should use
this library to access the policy store. The policy store holds all the policy
information, and is found at <code class="filename">/etc/selinux/<em
class="replaceable"><code>policyname</code></em>/modules/</code>.
</div><div class="para">
You should never have to edit the store directly. Instead, you should use tools that
link against libsemanage. One example tool is <code
class="command">semanage</code>, which is a command line tool for
managing much of the policy such as SELinux user mappings, SELinux port mappings, and file
contexts entries. Other examples of tools that use libsemanage include <code
class="command">semodule</code> which uses it to manage the SELinux
policy modules installed to the policy store and <code
class="command">setsebool</code> which uses it manage SELinux policy
booleans. Additionally, graphical tools are currently being developed to utilize the
functionality provided by libsemanage.
</div></div></div></div></div><div
class="qandadiv"><h4 class="title"
id="id2929042">1.2. Controlling SELinux</h4></div><div
class="toc"><dl><dt>Q: <a href="#id2929048">
How do I install/not install SELinux?
</a></dt><dt>Q: <a href="#id2929075">
As an administrator, what do I need to do to configure SELinux for my system?
</a></dt><dt>Q: <a
href="#qa-using-s-c-securitylevel">
How do I enable/disable SELinux protection on specific daemons under the targeted
policy?
</a></dt><dt>Q: <a href="#faq-entry-local.te">
In the past I have written local.te file in policy sources for my own local
customization to policy, how do I do this in Fedora 5?
</a></dt><dt>Q: <a href="#id2929497">
I have some avc denials that I would like to allow, how do I do this?
</a></dt><dt>Q: <a href="#id2929670">
How can I help write policy?
</a></dt><dt>Q: <a href="#id3069707">
How do I switch the policy I am currently using?
</a></dt><dt>Q: <a href="#id3069893">
How can I back up files from an SELinux file system?
</a></dt><dt>Q: <a href="#faq-entry-public_html">
How do I make a user public_html directory work under SELinux?
</a></dt><dt>Q: <a href="#id3070107">
How do I turn SELinux off at boot?
</a></dt><dt>Q: <a href="#id3070170">
How do I turn enforcing on/off at boot?
</a></dt><dt>Q: <a href="#id3070271">
How do I temporarily turn off enforcing mode without having to reboot?
</a></dt><dt>Q: <a href="#id3070304">
How do I turn system call auditing on/off at boot?
</a></dt><dt>Q: <a href="#id3070350">
How do I temporarily turn off system-call auditing without having to reboot?
</a></dt><dt>Q: <a href="#id3070377">
How do I get status info about my SELinux installation?
</a></dt><dt>Q: <a href="#id3070407">
How do I write policy to allow a domain to use pam_unix.so?
</a></dt><dt>Q: <a href="#id3070489">
I created a new Policy Package, where do I put it to make sure that it gets loaded
into the kernel?
</a></dt></dl></div><div
class="qandadiv"><div class="qandaentry"><div
class="question"
id="id2929048"><label>Q:</label><div
class="data"><div class="para">
How do I install/not install SELinux?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The installer follows the choice you make in the <span
class="guilabel"><strong>Firewall
Configuration</strong></span> screen. The default running policy is the
targeted policy, and it is on by default.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id2929075"><label>Q:</label><div
class="data"><div class="para">
As an administrator, what do I need to do to configure SELinux for my system?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The answer might be nothing. There are many Fedora users that don't even realize
that they are using SELinux. SELinux provides protection for their systems with an
out-of-the-box configuration. That said, there are a couple of things an administrator
might want to do to configure their system. These include:
</div><div class="variablelist"><dl><dt><span
class="term">booleans</span></dt><dd><div
class="para">
Booleans are settings that can be flipped to alter SELinux policy behavior
without having to write new policy. There are many booleans that can be set in Fedora, and
they allow an administrator to configure SELinux to a great degree. To view the available
booleans and modify their settings, use <code
class="command">system-config-selinux</code> or the command line tool
<code class="command">setsebool</code>.
</div></dd><dt><span class="term">setting
customizable file contexts</span></dt><dd><div
class="para">
Files on an SELinux system have a security context which is stored in the
extended attribute of the file (behavior can vary from filesystem to filesystem, but this
is how ext3 works). These are set by <code
class="command">rpm</code> automatically, but sometimes a user might
want to set a particular context on a file. An example would be setting the context on a
<code class="filename">public_html</code> directory so that <code
class="command">apache</code> can access it, as illustrated in <a
class="xref" href="#faq-entry-public_html" title="Q:">How
do I make a user public_html directory work under SELinux</a>.
</div><div class="para">
For a list of types that you might want to assign to files, see <code
class="filename">/etc/selinux/targeted/contexts/customizable_types</code>.
These are types commonly assigned to files by users and administrators. To set these, use
the <code class="command">chcon</code> command. Note that the types
in <code class="filename">customizable_types</code> are also
preserved after a relabel, so relabeling the system will not undo this.
</div></dd><dt><span class="term">making badly
behaving libraries work</span></dt><dd><div
class="para">
There are many libraries around that behave badly and try to break the memory
protections SELinux provides. These libraries should really be fixed, so please file a bug
with the library maintainer. That said, they can be made to work. More information and
solutions to make the libraries work can be found in <a class="xref"
href="#faq-entry-unconfined_t" title="Q:">I have a process running
as unconfined_t, and SELinux is still preventing my application from running</a>.
</div></dd></dl></div></div></div></div><div
class="qandaentry"><div class="question"
id="qa-using-s-c-securitylevel"><label>Q:</label><div
class="data"><div class="para">
How do I enable/disable SELinux protection on specific daemons under the targeted
policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Use <code class="command">system-config-selinux</code>, also
known as the <span class="application"><strong>Security Level
Configuration</strong></span> graphical tool, to control the Boolean values of
specific daemons. For example, if you need to disable SELinux for Apache to run correctly
in your environment, you can disable the value in <code
class="command">system-config-selinux</code>. This change disables the
transition to the policy defined in <code
class="filename">apache.te</code>, allowing <code
class="command">httpd</code> to remain under regular Linux DAC
security.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="faq-entry-local.te"><label>Q:</label><div
class="data"><div class="para">
In the past I have written local.te file in policy sources for my own local
customization to policy, how do I do this in Fedora 5?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Since Fedora 5 uses a modular policy, you don't have to have the complete policy
source any more. Now, you can just create a local policy module for your local policy
customizations. To do this, follow these steps.
</div><div class="procedure"><ol
class="1"><li class="step" title="Step 1"><div
class="para">
Create a temporary directory, and change into it.
</div><pre class="screen">
<code class="computeroutput">$ mkdir foo $ cd foo</code>
</pre></li><li class="step" title="Step 2"><div
class="para">
Create empty te, if, and fc files.
</div><pre class="screen">
<code class="computeroutput">$ touch local.te local.if
local.fc</code>
</pre></li><li class="step" title="Step 3"><div
class="para">
Edit the local.te file, adding appropriate content. For example:
</div><pre class="screen">
policy_module(local, 1.0)
require {
attribute httpdcontent;
type smbd_t;
}
allow smbd_t httpdcontent:dir create_dir_perms;
allow smbd_t httpdcontent:{ file lnk_file } create_file_perms;
</pre><div class="para">
There are 3 parts to this file.
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The <code class="computeroutput">policy_module</code> call
inserts statements to make the module work, including declaring the module and requiring
system roles, classes, and permissions. Make sure the name declared here (local in this
case) matches the name you gave the file (local.te).
</div></li><li class="listitem"><div
class="para">
The <code class="computeroutput">require</code> block
lists the symbols that this module uses that must be declared in other modules. In this
case, we require the attribute <code
class="computeroutput">httpdcontent</code> and the type <code
class="computeroutput">smbd_t</code>. Note that all types and
attributes you use in rules must be required here unless you are declaring them yourself
below.
</div></li><li class="listitem"><div
class="para">
The rest of the file is the policy, in this case consisting only of a couple of
allow rules. You could also place type declarations, dontaudit statements, interface
calls, or most things that can go in a normal te file here.
</div></li></ul></div></li><li
class="step" title="Step 4"><div class="para">
Build the policy module.
</div><pre class="screen">
$ make -f /usr/share/selinux/devel/Makefile
Compliling targeted local module
/usr/bin/checkmodule: loading policy configuration from tmp/local.tmp
/usr/bin/checkmodule: policy configuration loaded
/usr/bin/checkmodule: writing binary representation (version 5) to tmp/local.mod
Creating targeted local.pp policy package
rm tmp/local.mod.fc tmp/local.mod
</pre><div class="para">
Note that this uses <code
class="command">checkmodule</code>, which is part of the checkpolicy
rpm. So, make sure you install this rpm before doing this.
</div></li><li class="step" title="Step
5"><div class="para">
Become root, and install the policy module with <code
class="command">semodule</code>.
</div><pre class="screen">
<code class="computeroutput">$ su Password: # semodule -i
local.pp</code>
</pre></li></ol></div><div
class="note"><h2>Module are uniquely identified by
name</h2><div class="para">
This means that if you later insert another <code
class="filename">local.pp</code>, it will replace the one you just
loaded. So, you should keep this <code
class="filename">local.te</code> around, and just add to it if you need
to make later policy customizations. If you lose it, but want to keep your previous policy
around, just call the new local policy module something else (say local2.te).
</div></div></div></div></div><div
class="qandaentry"><div class="question"
id="id2929497"><label>Q:</label><div
class="data"><div class="para">
I have some avc denials that I would like to allow, how do I do this?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
If you have specific AVC messages you can use <code
class="command">audit2allow</code> to generate a Type Enforcement file
that is ready to load as a policy module.
</div><pre class="screen">
<code class="command">audit2allow -M local <
/tmp/avcs</code>
</pre><div class="para">
This creates a <code class="filename">local.pp</code> which
you can then load into the kernel using <code class="command">semodule -i
local.pp</code>. You can also edit the <code
class="filename">local.te</code> to make additional customizations. To
create a module allowing all the denials since the last reboot that you can then
customize, execute the following:
</div><pre class="screen">
<code class="command">audit2allow -m local -l -i /var/log/messages
> local.te</code>
</pre><div class="para">
Note that the above assumes you are not using the audit daemon. If you were using
the audit daemon, then you should use <code
class="filename">/var/log/audit/audit.log</code> instead of <code
class="filename">/var/log/messages</code> as your log file. This
generates a <code class="filename">local.te</code> file, that looks
similar to the following:
</div><pre class="screen">
module local 1.0;
require {
class file { append execute execute_no_trans getattr ioctl read write };
type httpd_t;
type httpd_w3c_script_exec_t;
};
allow httpd_t httpd_w3c_script_exec_t:file { execute execute_no_trans getattr ioctl read
};
</pre><div class="para">
You can hand edit this file, removing allow statements that you don't want to
allow, and then recompile and reload it using
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<code class="command">checkmodule -M -m -o local.mod
local.te</code> to compile the te file. Note that <code
class="command">checkmodule</code> is part of the checkpolicy rpm, so
you need to have it installed.
</div></li><li class="listitem"><div
class="para">
<code class="command">semodule_package -o local.pp -m
local.mod</code> to create a policy package.
</div></li><li class="listitem"><div
class="para">
<code class="command">semodule -i local.pp</code> to add it
to the current machine's running policy. This installs a new module called local with
these rules into the module store.
</div></li></ul></div><div
class="note"><h2>Important</h2><div
class="para">
In order to load this newly created policy package into the kernel, you are
required to execute <code class="command">semodule -i
local.pp</code>
</div><div class="para">
Note that if you later install another module called local, it will replace this
module. If you want to keep these rules around, then you either need to append future
customizations to this local.te, or give future customizations a different name.
</div></div></div></div></div><div
class="qandaentry"><div class="question"
id="id2929670"><label>Q:</label><div
class="data"><div class="para">
How can I help write policy?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Your help is definitely appreciated.
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
You can start by joining the Fedora SELinux mailing list. You can subscribe and
read the archives at <a
href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list&quo...;.
</div></li><li class="listitem"><div
class="para">
The Unofficial FAQ has some generic policy writing HOWTO information. Refer to
<a
href="http://sourceforge.net/docman/display_doc.php?docid=14882&...
for more information.
</div></li><li class="listitem"><div
class="para">
Another new resource is the Writing SE Linux policy HOWTO, located online at <a
href="https://sourceforge.net/docman/display_doc.php?docid=21959&...;.
</div></li></ul></div><div class="para">
Also, since the Fedora policy is based on the <a class="xref"
href="#faq-entry-whatis-refpolicy" title="Q:">Reference
Policy</a>, you should look at the documentation on its project page. Another
excellent source of information is the example policy files in <code
class="filename">/usr/share/doc/selinux-policy-<em
class="replaceable"><code>>version<</code></em></code>
and <code class="filename">/usr/share/selinux/devel</code>.
</div><div class="para">
If you want to create a new policy domain, you can look at the interface files in
the <code class="filename">/usr/share/selinux/devel</code>
sub-directories. There is also a tool there to help you get started. The following
procedure is an example:
</div><div class="procedure"><ol
class="1"><li class="step" title="Step 1"><div
class="para">
Use the <code class="command">sepolgen</code> command to
generate your own <code class="filename">te</code>, <code
class="filename">fc</code> and <code
class="filename">if</code> files. The <code
class="command">sepolgen</code> command takes two parameters: the name
of the policy module and the full path to the executable. The following command gives a
usage example:
</div><pre class="screen">
<code class="command">sepolgen <em
class="replaceable"><code>mydaemon
/usr/sbin/mydaemon</code></em></code>
</pre><div class="para">
It will prompt you for a few common domain characteristics, and will create three
files: <code class="filename">mydaemon.te</code>, <code
class="filename">mydaemon.fc</code> and <code
class="filename">mydaemon.if</code>.
</div></li><li class="step" title="Step
2"><div class="para">
After you generate the policy files, use the supplied Makefile, <code
class="filename">/usr/share/selinux/devel/Makefile</code>, to build a
policy package (<code class="filename">mydaemon.pp</code>):
</div><pre class="screen">
<code class="command">make -f
/usr/share/selinux/devel/Makefile</code>
</pre></li><li class="step" title="Step 3"><div
class="para">
Now you can load the policy module, using <code
class="command">semodule</code>, and relabel the executable using
<code class="command">restorecon</code>:
</div><pre class="screen">
<code class="command">semodule -i <em
class="replaceable"><code>mydaemon.pp</code></em></code>
<code class="command">restorecon -v <em
class="replaceable"><code>/usr/sbin/mydaemon</code></em></code>
</pre></li><li class="step" title="Step 4"><div
class="para">
Since you have very limited policy for your executable, SELinux will prevent it
from doing much. Turn on permissive mode and then use the init script to start your
daemon:
</div><pre class="screen">
<code class="command">setenforce 0</code>
<code class="command">service <em
class="replaceable"><code>mydaemon</code></em>
restart</code>
</pre></li></ol></div><div class="para">
Now you can collect avc messages. You can use <code
class="command">audit2allow</code> to translate the avc messages to
allow rules and begin updating your <code
class="filename">mydaemon.te</code> file. You should search for
interface macros in the <code
class="filename">/usr/share/selinux/devel/include</code> directory and
use these instead of using the allow rules directly, whenever possible. <code
class="command">audit2allow -R</code> will attempt to find interfaces
that match the allow rule. If you want more examples of policy, you could always install
the selinux-policy src rpm, which contains all of the policy te files for the reference
policy.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3069707"><label>Q:</label><div
class="data"><div class="para">
How do I switch the policy I am currently using?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="caution"><h2>Use caution when
switching policy</h2><div class="para">
Other than trying out a new policy on a test machine for research purposes, you
should seriously consider your situation before switching to a different policy on a
production system. The act of switching is straightforward. This method is fairly safe,
but you should try it first on a test system.
</div></div><div class="para">
To use the automated method, run the <span
class="application"><strong>Security Level
Configuration</strong></span> tool. From the GUI Main Menu, select <span
class="guimenu"><strong>Desktop</strong></span> → <span
class="guisubmenu"><strong>System Settings</strong></span>
→ <span class="guimenuitem"><strong>Security
level</strong></span>, or from a terminal, run <code
class="command">system-config-selinux</code>. Change the policy as
desired and ensure that the <span class="guilabel"><strong>Relabel
on next reboot</strong></span> option is enabled.
</div><div class="para">
You can also perform these steps manually with the following procedure:
</div><div class="procedure"><ol
class="1"><li class="step" title="Step 1"><div
class="para">
Edit <code class="filename">/etc/selinux/config</code> and
change the type and the mode of policy:
</div><pre class="screen">
<strong class="userinput"><code>SELINUXTYPE=<em
class="replaceable"><code>policyname</code></em>
SELINUX=permissive</code></strong>
</pre><div class="para">
This step ensures are not locked out after rebooting. SELinux runs under the
correct policy, but does allow you to login if there is a problem such as incorrect file
context labeling.
</div></li><li class="step" title="Step
2"><div class="para">
Set the system to relabel the file system on reboot:
</div><pre class="screen">
<code class="command">touch /.autorelabel</code>
</pre></li><li class="step" title="Step 3"><div
class="para">
Reboot the system. A clean restart under the new policy allows all system
processes to be started in the proper context, and reveals any problems in the policy
change.
</div></li><li class="step" title="Step
4"><div class="para">
Confirm your changes took effect with the following command:
</div><pre class="screen">
<code class="command">sestatus -v</code>
</pre><div class="para">
With the new system running in <code
class="computeroutput">permissive</code> mode, check <code
class="filename">/var/log/messages</code> for <code
class="computeroutput">avc: denied</code> messages. These may indicate
a problem that needs to be solved for the system to run without trouble under the new
policy.
</div></li><li class="step" title="Step
5"><div class="para">
When you are satisfied that the system runs stable under the new policy, enable
enforcing by changing <code
class="computeroutput">SELINUX=enforcing</code>. You can either reboot
or run <code class="command">setenforce 1</code> to turn enforcing
on in real time.
</div></li></ol></div></div></div></div><div
class="qandaentry"><div class="question"
id="id3069893"><label>Q:</label><div
class="data"><div class="para">
How can I back up files from an SELinux file system?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You can now use the <code class="command">tar</code> command,
you do not need to use <code class="command">star</code>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="faq-entry-public_html"><label>Q:</label><div
class="data"><div class="para">
How do I make a user <code class="filename">public_html</code>
directory work under SELinux?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
This process presumes that you have enabled user public HTML directories in your
Apache configuration file, <code
class="filename">/etc/httpd/conf/httpd.conf</code>. This process only
covers serving static Web content. For more information about Apache; and SELinux, refer
to <a
href="http://fedora.redhat.com/docs/selinux-apache-fc3/">htt...;.
</div><div class="procedure"><ol
class="1"><li class="step" title="Step 1"><div
class="para">
If you do not already have a <code
class="filename">~/public_html</code> directory, create it and populate
it with the files and folders to be served.
</div><pre class="screen">
<strong class="userinput"><code>cd ~ mkdir public_html cp
/path/to/content ~/public_html</code></strong>
</pre></li><li class="step" title="Step 2"><div
class="para">
At this point, <code class="command">httpd</code> is
configured to serve the contents, but you still receive a <code
class="computeroutput">403 forbidden</code> error. This is because
<code class="command">httpd</code> is not allowed to read the
security type for the directory and files as they are created in the user's home
directory. Change the security context of the folder and its contents recursively using
the <code class="option">-R</code> option:
</div><pre class="screen">
<strong class="userinput"><code>ls -Z -d
public_html/</code></strong>
<code class="computeroutput">drwxrwxr-x auser auser
user_u:object_r:user_home_t public_html</code>
<strong class="userinput"><code>chcon -R -t httpd_user_content_t
public_html/ ls -Z -d public_html/</code></strong>
<code class="computeroutput">drwxrwxr-x auser auser
user_u:object_r:httpd_user_content_t public_html/</code>
<strong class="userinput"><code>ls -Z
public_html/</code></strong>
<code class="computeroutput">-rw-rw-r-- auser auser
user_u:object_r:httpd_user_content_t bar.html</code>
<code class="computeroutput">-rw-rw-r-- auser auser
user_u:object_r:httpd_user_content_t baz.html</code>
<code class="computeroutput">-rw-rw-r-- auser auser
user_u:object_r:httpd_user_content_t foo.html</code>
</pre><div class="para">
You may notice at a later date that the user field, set here to <code
class="computeroutput">user_u</code>, is changed to <code
class="computeroutput">system_u</code>. This does not affect how the
targeted policy works. The field that matters is the type field.
</div></li><li class="step" title="Step
3"><div class="para">
Your static webpages should now be served correctly. If you continue to have
errors, ensure that the Boolean which enables user home directories is enabled. You can
set it using <code class="command">system-config-selinux</code>.
Select the <span
class="guilabel"><strong>SELinux</strong></span> tab, and
then select the <span class="guilabel"><strong>Modify SELinux
Policy</strong></span> area. Select <code
class="computeroutput">Allow HTTPD to read home directories</code>. The
changes take effect immediately.
</div></li></ol></div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070107"><label>Q:</label><div
class="data"><div class="para">
How do I turn SELinux off at boot?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Set <code class="computeroutput">SELINUX=disabled</code> in
<code class="filename">/etc/selinux/config</code>.
</div><div class="para">
Alternatively, you can add <code
class="option">selinux=0</code> to your kernel boot parameters.
However, this option is not recommended.
</div><div class="caution"><h2>Be careful when disabling
SELinux</h2><div class="para">
If you boot with <code class="option">selinux=0</code>, any
files you create while SELinux is disabled do not have SELinux context information. The
file system is marked for relabeling at the next boot. If an unforeseen problem prevents
you from rebooting normally, you may need to boot in single-user mode for recovery. Add
the option <code class="option">emergency</code> to your kernel boot
parameters.
</div></div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070170"><label>Q:</label><div
class="data"><div class="para">
How do I turn enforcing on/off at boot?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You can specify the SELinux mode using the configuration file <code
class="filename">/etc/sysconfig/selinux</code>.
</div><pre class="screen">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=<strong class="userinput"><code><em
class="replaceable"><code>enforcing</code></em></code></strong>
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=<strong class="userinput"><code><em
class="replaceable"><code>targeted</code></em></code></strong>
</pre><div class="para">
Setting the value to <code
class="computeroutput">enforcing</code> is the same as adding <code
class="option">enforcing=1</code> to the kernel boot parameters.
Setting the value to <code class="computeroutput">permissive</code>
is the same as adding <code class="option">enforcing=0</code> to the
kernel boot parameters.
</div><div class="para">
However, setting the value to <code
class="computeroutput">disabled</code> is not the same as the <code
class="option">selinux=0</code> kernel boot parameter. Rather than
fully disabling SELinux in the kernel, the <code
class="computeroutput">disabled</code> setting instead turns enforcing
off and skips loading a policy.
</div><div class="important"><h2>SELinux Configuration
Precedence</h2><div class="para">
The command line kernel parameter overrides the configuration file.
</div></div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070271"><label>Q:</label><div
class="data"><div class="para">
How do I temporarily turn off enforcing mode without having to reboot?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Occasionally you may need to perform an action that is normally prevented by policy.
Run the command <code class="command">setenforce 0</code> to turn
off enforcing mode in real time. When you are finished, run <code
class="command">setenforce 1</code> to turn enforcing back on.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070304"><label>Q:</label><div
class="data"><div class="para">
How do I turn system call auditing on/off at boot?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Add <code class="option">audit=1</code> to your kernel command
line to turn system call auditing on. Add <code
class="option">audit=0</code> to your kernel command line to turn
system call auditing off.
</div><div class="para">
System-call auditing is <span
class="emphasis"><em>on</em></span> by default. When on, it
provides information about the system call that was executing when SELinux generated a
<code class="computeroutput">denied</code> message. The error
message is helpful when debugging policy.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070350"><label>Q:</label><div
class="data"><div class="para">
How do I temporarily turn off system-call auditing without having to reboot?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Run <code class="command">auditctl -e 0</code>. Note that this
command does not affect auditing of SELinux AVC denials.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070377"><label>Q:</label><div
class="data"><div class="para">
How do I get status info about my SELinux installation?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
As root, execute the command <code
class="command">/usr/sbin/sestatus -v</code>. For more information,
refer to the <code class="filename">sestatus(8)</code> manual page.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070407"><label>Q:</label><div
class="data"><div class="para">
How do I write policy to allow a domain to use pam_unix.so?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Very few domains in the SELinux world are allowed to read the <code
class="filename">/etc/shadow</code> file. There are constraint rules
that prevent policy writers from writing code like
</div><pre class="screen">
<code class="command">allow mydomain_t shadow_t:file read;</code>
</pre><div class="para">
In RHEL4 you can setup your domain to use the <code
class="command">unix_chkpwd</code> command. The easiest way is to use
the <code class="command">unix_chkpwd</code> attribute. So if you
were writing policy for an ftpd daemon you would write something like
</div><pre class="screen">
<code class="command">daemon_domain(vsftpd,
`auth_chkpwd')</code>
</pre><div class="para">
This would create a context where vsftpd_t -> chkpwd_exec_t ->
system_chkpwd_t which can read <code
class="filename">/etc/shadow</code>, while vsftpd_t is not able to read
it.
</div><div class="para">
In Fedora /RHEL5, add the rule
</div><pre class="screen">
<code class="command">auth_domtrans_chk_passwd(vsftpd_t)</code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id3070489"><label>Q:</label><div
class="data"><div class="para">
I created a new Policy Package, where do I put it to make sure that it gets loaded
into the kernel?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You need to execute the command <code class="command">semodule -i
myapp.pp</code>. This modifies the policy that is stored on the machine. Your policy
module now is loaded with the rest of the policy. You can even remove the pp file from the
system.
</div><div class="para">
<code class="command">semodule -l</code> lists the currently
loaded modules.
</div><pre class="screen">
<code class="computeroutput">#semodule -i myapp 1.2.1</code>
</pre><div class="para">
If you later would like to remove the policy package, you can execute <code
class="command">semodule -r myapp</code>.
</div></div></div></div></div><div
class="qandadiv"><h4 class="title"
id="faq-div-resolving-problems">1.3. Resolving
Problems</h4></div><div class="toc"><dl><dt>Q:
<a href="#id3070551">
Where are SELinux AVC messages (denial logs, etc.) stored?
</a></dt><dt>Q: <a href="#id3070593">
My application isn't working as expected and I am seeing avc: denied messages.
How do I fix this?
</a></dt><dt>Q: <a href="#id3070681">
I installed Fedora on a system with an existing /home partition, and now I can't
log in.
</a></dt><dt>Q: <a href="#id3070768">
After relabeling my /home using setfiles or fixfiles, am I still be able to read
/home with a non-SELinux-enabled system?
</a></dt><dt>Q: <a href="#id3070818">
How do I share directories using NFS between Fedora and non-SELinux systems?
</a></dt><dt>Q: <a href="#id3070880">
How can I create a new Linux user account with the user's home
</a></dt><dt>Q: <a href="#id3070962">
Does the su command change my SELinux identity and role?
</a></dt><dt>Q: <a href="#id3071028">
I'm having troubles with avc errors filling my logs for a particular program.
How do I choose not to audit the access for it?
</a></dt><dt>Q: <a href="#id3071089">
Even running in permissive mode, I'm getting a large number of avc denied
messages.
</a></dt><dt>Q: <a href="#id3071133">
I get a specific permission denial only when SELinux is in enforcing mode, but I
don't see any audit messages in /var/log/messages (or /var/log/audit/audit.log if
using the audit daemon). How can I identify the cause of these silent denials?
</a></dt><dt>Q: <a href="#id3071241">
Why do I not see the output when I run certain daemons in debug or interactive
mode?
</a></dt><dt>Q: <a href="#id3071332">
When I do an upgrade of the policy package (for example, using yum), what happens
with the policy? Is it updated automatically?
</a></dt><dt>Q: <a href="#id3071420">
If the policy shipping with an application package changes in a way that requires
relabeling, will RPM handle relabeling the files owned by the package?
</a></dt><dt>Q: <a href="#id3071498">
Why do binary policies distributed with Fedora, such as
/etc/selinux/<policyname>/policy/policy.<version>, and those I
compile myself have different sizes and MD5 checksums?
</a></dt><dt>Q: <a href="#id3071561">
Will new policy packages disable my system?
</a></dt><dt>Q: <a href="#id3071597">
My console is being flooded with messages. How do I turn them off?
</a></dt><dt>Q: <a href="#id3071628">
Can I test the default policy without installing the policy source?
</a></dt><dt>Q: <a href="#id3071712">
Why are some of my KDE applications having trouble under SELinux?
</a></dt><dt>Q: <a href="#id3071784">
Why does SELINUX=disabled not work for me?
</a></dt><dt>Q: <a href="#faq-entry-unconfined_t">
I have a process running as unconfined_t, and SELinux is still preventing my
application from running.
</a></dt><dt>Q: <a href="#id3071992">
What do these rpm errors mean?
</a></dt><dt>Q: <a href="#id3072060">
I want to run a daemon on a non standard port but SELinux will not allow me. How do
get this to work?
</a></dt><dt>Q: <a href="#id3072095">
I am writing a php script that needs to create files and possibly execute them.
SELinux policy is preventing this. What should I do?
</a></dt><dt>Q: <a href="#id3072149">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</a></dt><dt>Q: <a href="#id3072186">
Please explain the relabelto/relabelfrom permissions?
</a></dt></dl></div><div
class="qandadiv"><div class="qandaentry"><div
class="question"
id="id3070551"><label>Q:</label><div
class="data"><div class="para">
Where are SELinux AVC messages (denial logs, etc.) stored?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
In Fedora 2 and 3, SELinux AVC messages could be found in <code
class="filename">/var/log/messages</code>. In Fedora 4, the audit
daemon was added, and these messages moved to <code
class="filename">/var/log/audit/audit.log</code>. In Fedora 5, the
audit daemon is not installed by default, and consequently these messages can be found in
<code class="filename">/var/log/messages</code> unless you choose to
install and enable the audit daemon, in which case AVC messages will be in <code
class="filename">/var/log/audit/audit.log</code>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070593"><label>Q:</label><div
class="data"><div class="para">
My application isn't working as expected and I am seeing <code
class="computeroutput">avc: denied</code> messages. How do I fix this?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
This message means that the current SELinux policy is not allowing the application
to do something. There are a number of reasons this could happen.
</div><div class="para">
First, one of the files the application is trying to access could be mislabeled. If
the AVC message refers to a specific file, inspect its current label with <code
class="command">ls -alZ <em
class="replaceable"><code>/path/to/file</code></em></code>.
If it seems wrong, use the command <code class="command">restorecon -v
<em
class="replaceable"><code>/path/to/file</code></em></code>
to restore the file's default context. If you have a large number of denials related
to files, you may want to use <code class="command">fixfiles
relabel</code>, or run <code class="command">restorecon -R <em
class="replaceable"><code>/path</code></em></code> to
recursively relabel a directory path.
</div><div class="para">
Denials are sometimes due to a configuration change in the program that triggered
the denial message. For example, if you change Apache to also listen on port 8800, you
must also change the security policy, <code
class="filename">apache.te</code>.
</div><div class="para">
If you are having trouble getting a specific application like Apache to work, refer
to <a class="xref" href="#qa-using-s-c-securitylevel"
title="Q:">How to use system-config-selinux</a> for information on
disabling enforcement just for that application.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070681"><label>Q:</label><div
class="data"><div class="para">
I installed Fedora on a system with an existing <code
class="filename">/home</code> partition, and now I can't log in.
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Your <code class="filename">/home</code> partition is not
labeled correctly. You can easily fix this two different ways.
</div><div class="para">
If you just want to relabel <code
class="filename">/home</code> recursively:
</div><pre class="screen">
<code class="command">/sbin/restorecon -v -R /home</code>
</pre><div class="para">
If you want to be sure there are no other files incorrectly labeled, you can relabel
the entire file system:
</div><pre class="screen">
<code class="command">/sbin/fixfiles relabel</code>
</pre><div class="para">
You must have the <code
class="filename">policycoreutils</code> package installed to use
<code class="command">fixfiles</code>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070768"><label>Q:</label><div
class="data"><div class="para">
After relabeling my <code class="filename">/home</code> using
<code class="command">setfiles</code> or <code
class="command">fixfiles</code>, am I still be able to read <code
class="filename">/home</code> with a non-SELinux-enabled system?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You can read the files from a non-SELinux distribution, or one with SELinux
disabled. However, files created by a system not using SELinux systems do not have a
security context, nor do any files you remove and recreate. This could be a challenge with
files such as <code class="filename">~/.bashrc</code>. You may have
to relabel <code class="filename">/home</code> when you reboot the
SELinux enabled Fedora system.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070818"><label>Q:</label><div
class="data"><div class="para">
How do I share directories using NFS between Fedora and non-SELinux systems?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Just as NFS transparently supports many file system types, it can be used to share
directories between SELinux and non-SELinux systems.
</div><div class="para">
When you mount a non-SELinux file system via NFS, by default SELinux treats all the
files in the share as having a context of <code
class="computeroutput">nfs_t</code>. You can override the default
context by setting it manually, using the <code
class="option">context=</code> option. The following command makes the
files in the NFS mounted directory appear to have a context of <code
class="computeroutput">system_u:object_r:tmp_t</code> to SELinux:
</div><pre class="screen">
<code class="command">mount -t nfs -o context=system_u:object_r:tmp_t
server:/shared/foo /mnt/foo</code>
</pre><div class="para">
When SELinux exports a file system via NFS, newly created files have the context of
the directory they were created in. In other words, the presence of SELinux on the remote
mounting system has no effect on the local security contexts.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070880"><label>Q:</label><div
class="data"><div class="para">
How can I create a new Linux user account with the user's home
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You can create your new user with the standard <code
class="command">useradd</code> command. First you must become <code
class="systemitem">root</code>.
</div><div class="para">
For the targeted policy:
</div><pre class="screen">
<strong class="userinput"><code>su - root id
-Z</code></strong>
<code class="computeroutput">root:system_r:unconfined_t</code>
<strong class="userinput"><code>useradd auser ls -Z
/home</code></strong>
<code class="computeroutput">drwx------ auser auser
root:object_r:user_home_dir_t /home/auser</code>
</pre><div class="para">
The initial context for a new user directory has an identity of <code
class="computeroutput">root</code>. Subsequent relabeling of the file
system changes the identity to <code
class="computeroutput">system_u</code>. These are functionally the same
since the role and type are identical (<code
class="computeroutput">object_r:user_home_dir_t</code>.)
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3070962"><label>Q:</label><div
class="data"><div class="para">
Does the <code class="command">su</code> command change my
SELinux identity and role?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
In previous versions of Fedora, security context transitions were integrated into
the <code class="command">su</code> via <code
class="computeroutput">pam_selinux</code>. This turned out to be more
trouble than it was worth, and is quite unnecessary on a system running targeted policy.
So, this is no longer the case. Now, <code
class="command">su</code>/<code
class="command">sudo</code> only change the Linux identy. You will need
to use <code class="command">newrole</code> to change the SELinux
identity, role, or level.
</div><div class="para">
Other forms of Linux/<span class="trademark">UNIX</span>®
identity change, for example <code class="command">setuid(2)</code>,
also do not cause an SELinux identity change.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071028"><label>Q:</label><div
class="data"><div class="para">
I'm having troubles with <code class="command">avc</code>
errors filling my logs for a particular program. How do I choose not to audit the access
for it?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
If you wanted to not audit <code class="command">dmesg</code>,
for example, you would put this in your <code
class="filename">dmesg.te</code> file:
</div><pre class="screen">
<strong class="userinput"><code>dontaudit dmesg_t userdomain:fd {
use };</code></strong>
</pre><div class="para">
This eliminates the error output to the terminal for all user domains, including
<code class="varname">user</code>, <code
class="varname">staff</code> and <code
class="varname">sysadm</code>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071089"><label>Q:</label><div
class="data"><div class="para">
Even running in permissive mode, I'm getting a large number of <code
class="computeroutput">avc denied</code> messages.
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
In a non-enforcing mode, you should actually receive <span
class="emphasis"><em>more</em></span> messages than in
enforcing mode. The kernel logs each access denial as if you were in an enforcing mode.
Since you are not restricted by policy enforcement, you can perform more actions, which
results in more denials being logged.
</div><div class="para">
If an application running under an enforcing mode is denied access to read a number
of files in a directory, it is stopped once at the beginning of the action. In a
non-enforcing mode, the application is not stopped from traversing the directory tree, and
generates a denial message for each file read in the directory.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071133"><label>Q:</label><div
class="data"><div class="para">
I get a specific permission denial only when SELinux is in enforcing mode, but I
don't see any audit messages in <code
class="filename">/var/log/messages</code> (or <code
class="filename">/var/log/audit/audit.log</code> if using the audit
daemon). How can I identify the cause of these silent denials?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The most common reason for a silent denial is when the policy contains an explicit
<code class="computeroutput">dontaudit</code> rule to suppress audit
messages. The <code class="computeroutput">dontaudit</code> rule is
often used this way when a benign denial is filling the audit logs.
</div><div class="para">
To look for your particular denial, enable auditing of all <code
class="computeroutput">dontaudit</code> rules:
</div><pre class="screen">
<code class="command">semodule -b
/usr/share/selinux/targeted/enableaudit.pp</code>
</pre><div class="caution"><h2>Enabled <code
class="computeroutput">dontaudit</code> output is
verbose</h2><div class="para">
Enabling auditing of all <code
class="computeroutput">dontaudit</code> rules likely produce a large
amount of audit information, most of which is irrelevant to your denial.
</div><div class="para">
Use this technique only if you are specifically looking for an audit message for a
denial that seems to occur silently. You want to re-enable <code
class="computeroutput">dontaudit</code> rules as soon as possible.
</div></div><div class="para">
Once you have found your problem you can reset to the default mode by executing
</div><pre class="screen">
<code class="command">semodule -b
/usr/share/selinux/targeted/base.pp</code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id3071241"><label>Q:</label><div
class="data"><div class="para">
Why do I not see the output when I run certain daemons in debug or interactive
mode?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
SELinux intentionally disables access to the tty devices to stop daemons from
communicating back with the controlling terminal. This communication is a potential
security hole because such daemons could insert commands into the controlling terminal. A
broken or compromised program could use this hole to cause serious problems.
</div><div class="para">
There are a few ways you can capture standard output from daemons. One method is to
pipe the output to the cat command.
</div><pre class="screen">
<code class="command">snmpd -v | cat</code>
</pre><div class="para">
When debugging a daemon, you may want to turn off the transition of the daemon to
its specific domain. You can do this using <code
class="command">system-config-selinux</code> or <code
class="command">setsebool</code> on the command line.
</div><div class="para">
A final option is to turn off enforcing mode while debugging. Issue the command
<code class="command">setenforce 0</code> to turn off enforcing
mode, and use the command <code class="command">setenforce 1</code>
to re-enable SELinux when you are finished debugging.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071332"><label>Q:</label><div
class="data"><div class="para">
When I do an upgrade of the policy package (for example, using <code
class="command">yum</code>), what happens with the policy? Is it
updated automatically?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Policy reloads itself when the package is updated. This behavior replaces the manual
<code class="command">make load</code>.
</div><div class="para">
In certain situations, you may need to relabel the file system. This might occur as
part of an SELinux bug fix where file contexts become invalid, or when the policy update
makes changes to the file <code
class="filename">/etc/selinux/targeted/contexts/files/file_contexts</code>.
</div><div class="para">
After the file system is relabeled, a <code
class="command">reboot</code> is not required, but is useful in
ensuring every process and program is running in the proper domain. This is highly
dependent on the changes in the updated policy.
</div><div class="para">
To relabel, you have several options. You may use the <code
class="command">fixfiles</code> command:
</div><pre class="screen">
<code class="command">fixfiles relabel reboot</code>
</pre><div class="para">
Alternately, use the <code
class="filename">/.autorelabel</code> mechanism:
</div><pre class="screen">
<code class="command">touch /.autorelabel reboot</code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id3071420"><label>Q:</label><div
class="data"><div class="para">
If the policy shipping with an application package changes in a way that requires
relabeling, will RPM handle relabeling the files owned by the package?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Yes. The security contexts for the files owned by the package are stored in the
header data for the package. The file contexts are set directly after the <code
class="command">cpio</code> copy, as the package files are being put on
the disk.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071498"><label>Q:</label><div
class="data"><div class="para">
Why do binary policies distributed with Fedora, such as <code
class="filename">/etc/selinux/<em
class="replaceable"><code><policyname></code></em>/policy/policy.<em
class="replaceable"><code><version></code></em></code>,
and those I compile myself have different sizes and MD5 checksums?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
When you install a policy package, pre-compiled binary policy files are put directly
into <code class="filename">/etc/selinux</code>. The different build
environments will make target files that have different sizes and MD5 checksums.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071561"><label>Q:</label><div
class="data"><div class="para">
Will new policy packages disable my system?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
There is a possibility that changes in the policy package or in the policy shipping
with an application package can cause errors, more denials, or other unknown behaviors.
You can discover which package caused the breakage by reverting policy and application
packages one at a time. If you don't want to return to the previous package, the older
version of the configuration files will be saved with the extension <code
class="filename">.rpmsave</code>. Use the mailing lists, bugzilla, and
IRC to help you work through your problem. If you are able, write or fix policy to resolve
your problem.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071597"><label>Q:</label><div
class="data"><div class="para">
My console is being flooded with messages. How do I turn them off?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
To regain useful control, turn off kernel messages to the console with this
command:
</div><pre class="screen">
<code class="command">dmesg -n 1</code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id3071628"><label>Q:</label><div
class="data"><div class="para">
Can I test the default policy without installing the policy source?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You can test SELinux default policy by installing just the <code
class="filename">selinux-policy-<em
class="replaceable"><code>policyname</code></em></code>
and <code class="filename">policycoreutils</code> packages. Without
the policy source installed, the <code
class="command">fixfiles</code> command automates the file system
relabeling.
</div><div class="para">
The command <code class="command">fixfiles relabel</code> is
the equivalent of <code class="command">make relabel</code>. During
the relabeling, it will delete all of the files in <code
class="filename">/tmp</code>, cleaning up files which may have old file
context labels.
</div><div class="para">
Other commands are <code class="command">fixfiles
check</code>, which checks for mislabeled files, and <code
class="command">fixfiles restore</code>, which fixes the mislabeled
files but does not delete the files in <code
class="filename">/tmp</code>. The <code
class="command">fixfiles</code> command does not take a list of
directories as an argument, because it relabels the entire file system. If you need to
relabel a specific directory path, use <code
class="command">restorecon</code>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071712"><label>Q:</label><div
class="data"><div class="para">
Why are some of my KDE applications having trouble under SELinux?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
KDE executables always appear as <code
class="command">kdeinit</code>, which limits what can be done with
SELinux policy. This is because every KDE application runs in the domain for <code
class="command">kdeinit</code>.
</div><div class="para">
Problems often arise when installing SELinux because it is not possible to relabel
<code class="filename">/tmp</code> and <code
class="filename">/var/tmp</code>. There is no good method of
determining which file should have which context.
</div><div class="para">
The solution is to fully log out of KDE and remove all KDE temporary files:
</div><pre class="screen">
<code class="command">rm -rf /var/tmp/kdecache-<em
class="replaceable"><code><username></code></em>
rm -rf /var/tmp/<em
class="replaceable"><code><other_kde_files></code></em></code>
</pre><div class="para">
At your next login, your problem should be fixed.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071784"><label>Q:</label><div
class="data"><div class="para">
Why does <code class="option">SELINUX=disabled</code> not work
for me?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Be careful of white space in the file <code
class="filename">/etc/sysconfig/selinux</code>. The code is very
sensitive to white space, even trailing space.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="faq-entry-unconfined_t"><label>Q:</label><div
class="data"><div class="para">
I have a process running as <code
class="computeroutput">unconfined_t</code>, and SELinux is still
preventing my application from running.
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
We have begun to confine the <code
class="computeroutput">unconfined_t</code> domain somewhat. SELinux
restricts certain memory protection operation. Following is a list of those denials, as
well as possible reasons and solutions for those denials. For more information on these
restrictions, see <a
href="http://people.redhat.com/drepper/selinux-mem.html">htt...;.
</div><div class="para">
These show up in <code
class="filename">/var/log/messages</code> (or <code
class="filename">/var/log/audit/audit.log</code> if using the audit
daemon) as avc denials. These can also show up when running programs with errors like
</div><pre class="screen">
error while loading shared libraries: /usr/lib/libavutil.so.49:
cannot restore segment prot after reloc: Permission denied
</pre><div class="para">
which indicates that the library is trying to perform a text relocation and failing.
Text relocations are bad, but can be allowed via the first hint below. Below are the
SELinux memory permissions that are denied, as well as hints at how to address these
denials.
</div><div class="variablelist"><dl><dt><span
class="term"><code
class="computeroutput">execmod</code></span></dt><dd><div
class="para">
This is usually based on a library label. You can permanently change the context
on the library with the following commands
</div><pre class="screen">
# /usr/sbin/semanage fcontext -a -t textrel_shlib_t
'/usr/lib/libavutil.so.49.0.0'
# /sbin/restorecon -v /usr/lib/libavutil.so.49.0.0
</pre><div class="para">
with the particular library at fault in place of <code
class="filename">/usr/lib/libavutil.so.49.0.0</code>. Now your
application should be able to run. Please report this as a bugzilla.
</div></dd><dt><span class="term"><code
class="computeroutput">execstack</code></span></dt><dd><div
class="para">
Attempt to <code class="command">execstack -c <em
class="replaceable"><code>LIBRARY</code></em></code>.
Now try your application again. If the application now works, the library was mistakenly
marked as requiring <code class="computeroutput">execstack</code>.
Please report this as a bugzilla.
</div></dd><dt><span class="term"><code
class="computeroutput">execmem,
execheap</code></span></dt><dd><div class="para">
A boolean for each one of these memory check errors have been provided. So if you
need to run an application requiring either of these permissions, you can set the boolean
allow_exec* to fix the problem. For instance if you try to run an application and you get
an AVC message containing an <code
class="computeroutput">execstack</code> failure. You can set the
boolean with
</div><pre class="screen">
<code class="command">setsebool -P allow_execstack=1</code>
</pre></dd></dl></div></div></div></div><div
class="qandaentry"><div class="question"
id="id3071992"><label>Q:</label><div
class="data"><div class="para">
What do these rpm errors mean?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><pre class="screen">
restorecon reset /etc/modprobe.conf context
system_u:object_r:etc_runtime_t->system_u:object_r:modules_conf_t
restorecon reset /etc/cups/ppd/homehp.ppd context
user_u:object_r:cupsd_etc_t->system_u:object_r:cupsd_rw_etc_t
</pre><div class="para">
During the update process, the selinux package runs restorecon on the difference
between the previously install policy file_context and the newly install policy context.
This maintains the correct file context on disk.
</div><pre class="screen">
<code class="computeroutput">libsepol.sepol_genbools_array: boolean
hidd_disable_trans no longer in policy</code>
</pre><div class="para">
This indicates that the updated policy has removed the boolean from policy.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3072060"><label>Q:</label><div
class="data"><div class="para">
I want to run a daemon on a non standard port but SELinux will not allow me. How do
get this to work?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You can use the <code class="command">semanage</code> command
to define additional ports. So say you want httpd to be able to listen on port 8082. You
could enter the command.
</div><pre class="screen">
<code class="command">semanage port -a -p tcp -t http_port_t
8082</code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id3072095"><label>Q:</label><div
class="data"><div class="para">
I am writing a php script that needs to create files and possibly execute them.
SELinux policy is preventing this. What should I do?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
First, you should never allow a system service to execute anything it can write.
This gives an attacker the ability to upload malicious code to the server and then execute
it, which is something we want to prevent.
</div><div class="para">
If you merely need to allow your script to create (non-executable) files, this is
possible. That said, you should avoid having system applications writing to the <code
class="filename">/tmp</code> directory, since users tend to use the
<code class="filename">/tmp</code> directory also. It would be
better to create a directory elsewhere which could be owned by the apache process and
allow your script to write to it. You should label the directory <code
class="computeroutput">httpd_sys_script_rw_t</code>, which will allow
apache to read and write files to that directory. This directory could be located anywhere
that apache can get to (even <code
class="filename">$HOME/public_html/</code>).
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3072149"><label>Q:</label><div
class="data"><div class="para">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
You need to identify the swapfile to SELinux by setting its file context to <code
class="computeroutput">swapfile_t</code>.
</div><pre class="screen">
<code class="command">chcon -t swapfile_t <em
class="replaceable"><code>SWAPFILE</code></em></code>
</pre></div></div></div><div
class="qandaentry"><div class="question"
id="id3072186"><label>Q:</label><div
class="data"><div class="para">
Please explain the <code
class="computeroutput">relabelto</code>/<code
class="computeroutput">relabelfrom</code> permissions?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
For files, <code class="computeroutput">relabelfrom</code>
means "Can domain D relabel a file from (i.e. currently in) type T1?" and
<code class="computeroutput">relabelto</code> means "Can domain
D relabel a file to type T2?", so both checks are applied upon a file relabeling,
where T1 is the original type of the type and T2 is the new type specified by the
program.
</div><div class="para">
Useful documents to look at:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Object class and permission summary by Tresys <a
href="http://tresys.com/selinux/obj_perms_help.shtml">http:/...
</div></li><li class="listitem"><div
class="para">
Implementing SELinux as an LSM technical report (describes permission checks on a
per-hook basis) <a
href="http://www.nsa.gov/selinux/papers/module-abs.cfm">http...;.
This is also available in the selinux-doc package (and more up-to-date there).
</div></li><li class="listitem"><div
class="para">
Integrating Flexible Support for Security Policies into the Linux Operating System
- technical report (describes original design and implementation, including summary tables
of classes, permissions, and what permission checks are applied to what system calls. It
is not entirely up-to-date with current implementation, but a good resource nonetheless).
<a
href="http://www.nsa.gov/selinux/papers/slinux-abs.cfm">http...
</div></li></ul></div></div></div></div></div><div
class="qandadiv"><h4 class="title"
id="faq-div-deploying-selinux">1.4. Deploying
SELinux</h4></div><div class="toc"><dl><dt>Q:
<a href="#id3072295">
What file systems can I use for SELinux?
</a></dt><dt>Q: <a href="#id3072333">
How does SELinux impact system performance?
</a></dt><dt>Q: <a href="#id3072362">
What types of deployments, applications, and systems should I leverage SELinux in?
</a></dt><dt>Q: <a href="#id3072425">
How does SELinux affect third-party applications?
</a></dt></dl></div><div
class="qandadiv"><div class="qandaentry"><div
class="question"
id="id3072295"><label>Q:</label><div
class="data"><div class="para">
What file systems can I use for SELinux?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The file system must support <code
class="computeroutput">xattr</code> labels in the right <em
class="parameter"><code>security.*</code></em> namespace.
In addition to ext2/ext3, XFS has recently added support for the necessary labels.
</div><div class="para">
Note that XFS SELinux support is broken in upstream kernel 2.6.14 and 2.6.15, but
fixed (worked around) in 2.6.16. Your kernel must include this fix if you choose to use
XFS with SELinux.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3072333"><label>Q:</label><div
class="data"><div class="para">
How does SELinux impact system performance?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
This is a variable that is hard to measure, and is heavily dependent on the tuning
and usage of the system running SELinux. When performance was last measured, the impact
was around 7% for completely untuned code. Subsequent changes in system components such as
networking are likely to have made that worse in some cases. SELinux performance tuning
continues to be a priority of the development team.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3072362"><label>Q:</label><div
class="data"><div class="para">
What types of deployments, applications, and systems should I leverage SELinux in?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Initially, SELinux has been used on Internet facing servers that are performing a
few specialized functions, where it is critical to keep extremely tight security.
Administrators typically strip such a box of all extra software and services, and run a
very small, focused set of services. A Web server or mail server is a good example.
</div><div class="para">
In these edge servers, you can lock down the policy very tightly. The smaller number
of interactions with other components makes such a lock down easier. A dedicated system
running a specialized third-party application would also be a good candidate.
</div><div class="para">
In the future, SELinux will be targeted at all environments. In order to achieve
this goal, the community and <em class="firstterm">independent software
vendors</em> (<abbr class="abbrev">ISV</abbr>s) must work with
the SELinux developers to produce the necessary policy.
</div><div class="para">
For more information about these policies, refer to <a class="xref"
href="#qa-whatis-policy" title="Q:">What is SELinux
policy?</a>.
</div></div></div></div><div
class="qandaentry"><div class="question"
id="id3072425"><label>Q:</label><div
class="data"><div class="para">
How does SELinux affect third-party applications?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
One goal of implementing a targeted SELinux policy in Fedora is to allow third-party
applications to work without modification. The targeted policy is transparent to those
unaddressed applications, and it falls back on standard Linux DAC security. These
applications, however, will not be running in an extra-secure manner. You or another
provider must write policy to protect these applications with MAC security.
</div><div class="para">
It is impossible to predict how every third-party application might behave with
SELinux, even running the targeted policy. You may be able to fix issues that arise by
changing the policy. You may find that SELinux exposes previously unknown security issues
with your application. You may have to modify the application to work under SELinux.
</div><div class="para">
Note that with the addition of <a class="xref"
href="#faq-entry-whatare-policy-modules" title="Q:">Policy
Modules</a>, it is now possible for third-party developers to include policy modules
with their application. If you are a third-party developer or a package-maintainer, please
consider including a policy module in your package. This will allow you to secure the
behavior of your application with the power of SELinux for any user installing your
package.
</div><div class="para">
One important value that Fedora testers and users bring to the community is
extensive testing of third-party applications. With that in mind, please bring your
experiences to the appropriate mailing list, such as the fedora-selinux list, for
discussion. For more information about that list, refer to <a
href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list/&qu...;.
</div></div></div></div></div></div></div></div></div></body></html>