Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Tag: selinux

  • RHEL6 – Managing SELinux Booleans

    BooitemThis is my second post on SELinux. In case you missed the first one you can read it here. Today we are going to specifically discuss SELinux booleans

    According to fedoraproject.org ,"SELinux booleans enable runtime customization of the SELinux policy. SELinux policy in Fedora has several booleans that allow you to quickly toggle a particular change in the policy." However i think its easier to explain them as SELinux configurations and settings that can be easily toggled on or toggled off.

    The command getsebool -a is used to display available booleans, while setsebool is used to modify them. Using setsebool with the -P options makes that modification persistent across reboots.

    To display a detailed list or booleans with descriptions run semanage boolean -l

    Some common SELinux booleans are below.

    ftp_home_dir   -> off   Allow ftp to read and write files in the user home directories

    httpd_enable_cgi     -> on    Allow httpd cgi support

    sftpd_anon_write      -> off   Allow anon internal-sftp to upload files, used for public file transfer services. Directories must be labeled public_content_rw_t.

    allow_ftpd_anon_write   -> off   Allow ftp servers to upload files,  used for public file transfer services. Directories must be labeled public_content_rw_t.

     

     

     

  • RHEL6 – SELinux Modes and Contexts

    Anime,art,cartoon,chibi,darth,vader,darthvader-26d94e794e11142d417a277b8fbdc0eb_hSELinux, or Security-Enhanced Linux as its known by the guy who invented it, is a Linux feature that provides an additional level of security by setting rules for which processes can access which files, directories, ports, etc.

    Display and Modify SELinux Modes:

    You can use /etc/sysconfig/selinux to change the default SELinux mode at boot, and the setenforce command can be used to change the default level on the fly. Getenforce can be used to determine the current SELinux mode. 

    # getenforce
    Enforcing

    Display SELinux Contexts:

    Under SELinux, every file, process, directory, or port is assigned a special security label called a context.

    To view the contexts assigned to a file or directory use the '-Z' option. Coupled with and 'ls" or a 'ps" this is a formidable command.

    To view a list of all possible assigned contexts use semanage.

    # semanage fcontext -l

    Modify SELinux Contexts:

    For example, lets create two test files in /tmp called testfile1 and testfile2, and then lets check their contexts.

    # ls -lZ test*
    -rw-r–r–. root root unconfined_u:object_r:user_tmp_t:s0 testfile1
    -rw-r–r–. root root unconfined_u:object_r:user_tmp_t:s0 testfile2

    Now compare this to the default context assigned to apache content

    # ls -ldZ /var/www/html
    drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html

    So lets say that I want to move testfile1 to /var/www/html and make it accessable via a webbrowser; in order to do this I must assign the correct context to the file using the restorecon command.

    # restorecon -Rv /var/www/html

    The command above restores or even better, allows the testfiles to inherit the contexts assigned to the parent directory, which in this case is /var/www/html/

    Add SELinux Contexts:

    Now lets say that you need to add a directory and apply a context directly to that directory, instead of allowing a context to be inheritted. For example, lets say that I need to setup an apache virtual server under /virtual_server2, so lets first create the directory and a simple index.html

    # mkdir /virtual_server2
    # vi /virtual_server2/index.html
    # ls -Zd /virtual_server2
    drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /virtual_server2

    # ls -Zd /virtual_server2/index.html
    -rw-r–r–. root root unconfined_u:object_r:default_t:s0 /virtual_server2/index.html

    Now we need to set and apply the correct http content context to /virtual_server2 and its contents (say that 5 times fast)

    # semanage fcontext -a -f "" -t httpd_sys_content_t '/virtual_server2(/.*)?'

    # restorecon -RFvvv /virtual_server2/

    restorecon reset /virtual_server2 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
    restorecon reset /virtual_server2/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0

    Now that our context is correct apache should have no issue serving up our new content (once configured on the apache side)

    # ls -Zd /virtual_server2/
    drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /virtual_server2/

     

     

     

     

     

     

  • RHCE Test Prep Oddities – Part 1

    Redhat I am pretty excited to say that I will be taking the RHCE in a month or so as part of a week long bootcamp.

    Now I use RHEL every day and have done so for several years and I have certain processes for doing things, and commands that I use all the time. Below is a list of information/commands that I just never used or are not familar with that I have run across in my search for test prep information.

    • touch /etc/forcefsck, forces a filesystem check at next reboot.
    • chattr – change file attributes, like chattr +i write protects a file
    • ntsysv -gui utility for managing startup services]
    • grub-install /dev/sda – reinstalls grub, do a –recheck first however
    • mdamd – use to manage software raid
    • /proc/mdstat – shows status of md devices
    • labelfs – used to label filesystems
    • system-config-network – gui for changing network configs
    • system-config-printer – gui for setting up printers
    • at, atq, atrm – schedule a one time job, view & remove jobs
    • yum groupinstall "x window system" - installs x
    • switchdesk gnome – sets gnome as default x window manager
    • squid -z – creates the disk space needed for squid proxy
    • sestatus -v – shows selinux status
    • system-config-selinux – gui for config of selinux