Table of Contents

SELinux

This document applies to Fedora 29. But, all should work on CentOS/REL 7.

General

Before you can work with all the selinux tools, you must install the following packages first: 

dnf -y install python3-policycoreutils policycoreutils-python-utils policycoreutils setroubleshoot-server setools-console libselinux-utils coreutils

File contexts

Note:seinfo is part of setools-console rpm package.
Note:You should grep for a context, or pipe into less!

The semanage command has tree switches:

Next, a few examples for managing context using semanage command:

Here, I show some examples for the regex:

To recuresively apply the context permanently, use this command:

Note:Usually it’s not a bad idea to use the -v switch, this shows, what it changes.

Boleans

Boleans are general values, they are valid for the whole system.

Note:Use grep or pipe into less!

Labeling

All changes, which where not saved, using restorcon command, will be lost, when you run a relabeling!

If you have to relable the system, just create /.autorelabel file and reboot the server.
Note:Before reboot, make sure selinux is in permissive mode! System does not always reboot after enforcing SELINUX.
Note:rd.break asks for a break at an early stage of the boot process. enforcing=0 puts the system into SELinux Permissive mode. Don’t confuse with selinux=0 that completely disables SELinux.

Analize autid log

Setup

Example applications

Nginx Proxy

HTTP

For example the Bolt CMS requires to write files in the in public, cache and config folders. But, selinux does not allow this per default.

Note:If you want to have those changes to default back, you must execute restorecon -R /<directory>!

Icinga

If the icinga service does not start after configuring API, you should check the following:

Piwik (Matomo)

Not yet done …

Configure non-standard ports

If you have an application which has not a standart port definition, you can also define a port for a service.

Problems during boot

Procedure to relabel

For a password change, next procedure is probably the easiest.

  1. Interrupt grub startup and type E to edit the default boot option
  2. Add at the line where linux16 is listed first, following rd.break enforcing=0
  3. Remount /sysroot, but writable: mount –o remount,rw /sysroot
  4. Do a chroot to /sysroot: chroot /sysroot
  5. Do your changes
  6. You have to relabel the filesystems, just touch /.autorelabel in /sysroot or reboot and add autorelabel=1 in grub

Boot parameters described

Creation of selinux module

Sometimes not all rules apply to a application. Then, you need to create your own selinux module. In this example the rrdtool binary:

  1. Get information from /var/log/audit/audti.log:
    p=rrdtool; grep 'comm="'$p /var/log/audit/audit.log | audit2allow -l
 
module local_rrdtool 1.0;
 
require {
	type httpd_t;
	type nagios_var_lib_t;
	class file map;
}
 
#============= httpd_t ==============
# src="httpd_t" tgt="nagios_var_lib_t" class="file", perms="map"
# comm="rrdtool" exe="" path=""
#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow httpd_t nagios_var_lib_t:file map;
  2. Create now the module configuration file *.te:
    p=rrdtool; grep 'comm="'$p /var/log/audit/audit.log | audit2allow -l -v -m local_$p > local_$p.te

    The result is now local_$p.te file.

  3. Check now the syntax of the config file:
    checkmodule -M -m -o local_$p.mod local_$p.te

    This creates the local_$p.mod file.

  4. Create now the module for selinux:
    semodule_package -o local_$p.pp -m local_$p.mod

    This results in local_$p.pp selinux module

  5. Activate the module and copy it to /usr/share/selinux/targeted directory:
    semodule -v -i local_$p.pp
Attempting to install module 'local_rrdtool.pp':
Ok: return value of 0.
Committing changes:
Ok: transaction number 21.
 
cp local_$p.pp /usr/share/selinux/targeted/

It's a good idea to use a prefix for the module name (in my case: local_)!

If you want to create a module for more than one binary (because they are part of an application), just use audit2allow -a to create the module configuration.

States of selinux