[No audio]
Security Enhanced Linux. Now a lot of
you are probably thinking, oh my god,
SELinux, that's very complicated. Okay.
I do agree it is somewhat complicated to a
degree but for people who have already spent time in
it and been working with SELinux already find it
easier than initially how they thought. So one thing I
will promise you that, I will try my best to
explain how SELinux works, but keep in mind it's a
very big topic, that I might not be able to
cover every aspect of SELinux. So again,
I'll try my best. So let's see, let's first talk about
what is SELinux? As a regular definition, it's Security-Enhanced
Linux it's a Linux kernel security module that provides a
mechanism for supporting access control security policy including mandatory access
control. I got this definition straight from Wikipedia. If you
go ahead and search online, you'll find that definition right
there. And the second thing I do want to cover
is it's a project of United States National Security Agency
NSA and the SELinux community.The other one, both
of them worked together, came up of course the beginning
NSA was the one who was involved, who wants to
enhance or add more security around Linux. So I have
gone over the definition of SELinux from Wikipedia, now I
am going to tell you exactly how I can explain
you in a graphical and easier way, and I really
hope that you understand how SELinux works and what is it for?
Let's take an example of a server. So we have
a Linux server, and it has directories, directory has files,
and all other different files in other directories, and also
the server has processes like NFS, web server, or FTP
server. Also it has sockets, that whenever it starts a
program to communicate to one another Linux machine it needs
to open up a socket and it has a memory.
All that is, as you know,
is managed or comes under the
ownership of users and groups right?
We all know that and how we control the permissions
is by of course reassigning them to who owns that
and which group owns that and then there is three
level of permission we do and that is read, write, executable,
and each one of them are divided into users the
first three bits for users,
second three bits for group, and the last three bits for
others. So all of that is controlled through change mod. So a
user can do change mod to whatever that they wanted to
change it to. So if you own a file, or if
you create a file let's call it file1, you could
do a change mod on that file, and control the permission
as however you want to view it. This type of access
is called DAC Discretionary Access Control, where user has control over
everything. Now comes the SELinux. What SELinux is, it's
basically a Mandatory access control, and it goes around this Discretionary Access Control.
So what it means that let's say you have a
user, and user is HTTP user in your environment, and
let's say that user has been compromised by a hacker.
So what I have is, if the
Apache HTTP Server is compromised, an attacker cannot use
the process to read files in user home directory,
unless a specific SELinux policy rule was added
or configured to allow such access.
In simple words, what I could show you here is if
that user, HTTP user, only if SELinux is enabled, what this
SELinux can do is it tells the user hey, you do
have access to this file, for example /var/www/html directory, but I
am not going to give you access to /var/www/cgi-bin.
Now think of it, both of these directories
are actually owned by that Http user, right?
So isn't that how funny it is that the same user
can access one directory and cannot access the other, or can
access one file but cannot access the other file.
Yes, that is possible through SELinux.
That's why they came in and said
hey guys, this is not good.
Maybe one user, let's say iafzal, can access a file
/home/iafzal in the file, but we don't want him
to access any other file in the same directory.
Well, it's because again, if that user is
compromised, that user can access other directories too.
And you want to prevent that.
So at the end, result is the user
cannot do change mod to whatever the user likes.
That's what SELinux is, that's how it enhances the
security of your Linux server.
Hopefully this diagram and me explaining this way
makes you understand how SELinux works and
why there's a need of SELinux.
Now, moving on, let's get into the detail of
the functionality of SELinux and how we could make
the use of it. SELinux Options, there are three
SELinux option. Number one by default, when you
have a Linux machine installed, primarily let's say in
Redhat, CentOS, and Fedora type of Linux distributions,
by default SELinux comes as enabled,
meaning it is an enforcing mode.
Then there's another mode that
is called permissive mode.
Permissive mode,
what it does is, it tells the SELinux hey, I'm
not going to enable you so don't do anything.
Only what you should do is, only log
the activity like as if you are enabled.
So this way if you are using the first time
as the Linux, then you should always do permissive.
So you could try and error, trial and error type
of things you could do unless you're fully comfortable.
Then you could go ahead and do enforcing.
Again, always try to do permissive than enforcing.
Then of course the third one would
be as you know, is disabled.
So if you do not want to use SELinux
at all, you could just go ahead and make it
disabled and none of its functionality would work at all.
Now, so far that I know, if I have
to ballpark I would say about 50% to 60%
of the time people have disabled SELinux.
And the reason, number one reason for being SELinux
disabled in the environment is because of course, as
I said, it is complicated, and a lot of
times people do find it complicated, and simply they
could go in and disable it.
But what my take is, that if you are
running any of your Linux machine in a DMZ
environment which is a public facing environment, then you
should definitely consider enabling SELinux.
OK, moving on. To check SELinux status, whether your system
is running SELinux or whether it has SELinux enabled
or not, you would do sestatus or getenforce.
This would tell you if your system has SELinux enabled
or not. Setting SELinux, you will have to do setenforce = 0, to
do permissive or disable mode, or
you could do setenforce = one to enable it.
But again, this will only enable or
disable while you are on the system.
The moment your system reboots
the setting will go away.
Now how you can make those settings permanent?
Just like any service, you have to modify SELinux config
file for permanent setting and that file is etc,
as always, etc is a configuration directory, so you should
have that in /etc/selinux/config file, and there is
a parameters inside of that configuration file that says,
SELINUX=enforcing, SELINUX=disabled, whichever the setting
that you want to pick, of course don't forget permissive.
Then before you modify SELinux config file that is
something definitely I wanted to tell you it is very
important even if you have to write it down, before
you play around with SELinux, please if it's a virtual machine,
create a snapshot of your VM. So stop
everything right now, go ahead and create a
snapshot before you try anything on the SELinux. Why?
The reason I'm saying that again,
SELinux is built around security.
If you make changes, that is not something that you
wanted to do maybe you're going to have a problem
booting up your system or it's going to take a
long time to label every file system.
Now what is labeling means?
We'll cover that later but again, my suggestion
to you right now is to go ahead
and create a snapshot of your virtual machine.
Now if you are running a physical machine, go
ahead and create a backup of your physical machine
or create some type of means where you could
revert back to your original setting.
Then before you reboot your system, let's say if you have enforced
SELinux in your /etc/selinux/config file, always do /.autorelabel.
This is going to tell the system hey,
I have just enabled disable SELinux especially enabling it.
Go ahead and relabel all the files, system directories,
whatever that you have, relabel them right now so
they are aware of SELinux enablement.
So make sure if you don't do that, then you have
to boot, then it has to go through the relabeling
again, it's going to take you really long time and you're
probably going to think your system is not booting up and
then you're going to try different things and you're going to
end up not booting up the system at all.
All right, I'm going to try a couple of
things to show you on my Linux machine how
to show whether it's enforced or not.
So I have my Linux machine open right here.
I am logged in as root.
As you could see, I have a pound sign, but still I
will always check to make sure I'm logged in as root.
So if I wanted to check the
status, I would do status, sestatus.
As you can see right now, it's the status enabled.
But don't go by this.
You have to do is right here, current mode.
It is saying that my current mode is
enforcing, meaning I do have SELinux and it
is enabled and running in my system.
You could also get the same result, not
exactly the same result, but you want to
find out whether it's enforced or not.
You do getenforce, and it will tell you this.
Yes, it is enforcing.
Again, if you wanted to set it to enforcing or
disabling, you have to do setenforce zero to disable,
one to enable. The file that you would need to
modify for permanent setting, that file is located at /etc/selinux.
Let's cat the file out, and file is config.
You can see in the file before I
had only this line SELINUX=enforcing.
I also added this line myself.
You probably don't see this line in
your configuration because I added that manually.
And the reason I added manually,
so this way I don't have to type it the disable
whole again or I don't want to make any mistake.
What I would do is I will go into the
file, take out the pound, add the pound here and
it will make the changes the way I want.
So that's the file you need to keep
in mind that you should make the change
to if you wanted to enforce or disable.
Moving on.
There are two main concepts of SELinux.
One is labeling and the other one is type enforcement.
So SELinux is running it's enforced.
Now, how does SELinux keep track of files,
directories, and all the processes that we talked about?
First thing that SELinux does, it labels every
file and directory in your file system.
Again, it's an enhanced way of enhancing your security,
and let's say if you have a file or a directory,
it creates a label with that, just like a label tag.
And that label has four different types of information.
One is the user, second is the role, third
is a type, and the fourth one is level.
I will mostly focus on the
type because most of the time
type is the one that is used, that keeps all
the files, ownership or security separate from one another.
To list the label of a directory, if you wanted
to see what type of label it has, you have
to do ls -lz, and /usr/sbin/httpd.
It's just the example that I picked.
This is the file and you will see as
a result it will come up as this.
And you see right here where I have highlighted in the
rectangular red object it has system which is for user object
which is for role httpd_exec_t, that's the
type and the last one is the level.
Again the main focus is httpd_exec, you will
find that every file or directory if they are in
a different directory, will have a different type.
As you know, this is executable
/usr/bin/httpd is an executable.
You could run that, it will start up a
script, and it will start your http process.
That is why it's been given the exec executable type.
Similarly, if you do want to list a directory, you would
have to do ls d for directory, and a z
again at /etc/httpd,
this is a directory for configuration file for httpd,
and the result will come up like this.
Again, same thing.
User is the same, role is the
same, but it has changed the type.
Type again is the most important part of
the thing that you have to work with
if you are going to copy the file.
Let's say that is in /usr/sbin/ or let's
say /var/www/html directory, and you move it somewhere else.
Remember one thing, it is not taking the permission
of the other or the source destination, sorry.
It is taking the information of the sources.
So you have to modify the type when you actually move
it, otherwise SELinux will not allow you to read it.
Okay, so let me try all of these commands.
[No audio]
Let me clear my screen.
And the first one I will try on ls -lZ /usr/sbin/httpd.
And as you can see right here, this is
what shows up and this is label of SELinux.
If I had SELinux disabled, it would
not have shown up right here.
Again the first one, all of this
label has four different categories and each
category is separated by the colon.
So first one again is user, second one is role, third
one is the type, and the last one is the level.
And again this is the most important one that you should
be focusing on, that you could make a change to.
All right, try on the directory ls -dZ /etc/httpd.
Again it is labeled as config, httpd_config,
this one was labeled executable.
You see the SELinux keeps the distinction between one
file or directory with another is by assigning these types
that it says hey, this is a config file.
Hey, this is executable file.
Now I'll see who has access to
executable and who has access to config.
[No audio]
If I were to do the same thing in my home directory, let's
say ls -dZ /home/iafzal, you will see it is coming as
user, which every user will have in the home_dir.
That's how you could differentiate as a home directory.
I could also make a change on
the user as well as the object.
All right, let's keep moving on.
[No audio]
As a web server runs, the process is labeled
in memory as well as like httpd _t.
So not only directories or files are labeled
by SELinux, the process is also labeled.
You could check that process label only if
it's running right because kernel starts up the
process and it keeps that process information memory.
Without starting it up, there won't be any label.
So to check while the process is running, you do ps,
ax, or whatever the option that you want to use, and
of course uppercase Z, and then grep for the process.
And you'll see, you get to list the
process depending on how many processes you're running.
And here is information about that
type that we talked about.
I'm sorry, I actually captured the system underscore
r as well, which is not the type.
The type is httpd_t.
All right, to check the this label, if
the label is assigned, it's a socket level.
Yes, it is.
And you'll see right here again,
I actually highlighted the wrong type.
system_r is the role, not the type.
So the type would be httpd_t.
All right, so let me try to look the
same thing for process and for the socket.
So first, before I look for it, I
wanted to make sure my httpd is running.
For those who do not have httpd installed in
your system, you first need to check whether you
have the package installed by running rpm -qa.
First of all, let me clear the
screen rpm -qa grep for http.
[No audio]
Okay, so I do have a package installed.
Now, if I have a package installed, I need to
run it, but of course before I run it, I'll
need to make sure whether it's running already or not.
So systemctl status httpd. Okay, it is not running,
it is inactive, as you can see right here.
So that is why even if I do ps -ef or whatever I
want to do and I type http, it's not going to grep it.
So I need to start it.
To start, I will use the
same command systemctl, instead of status
I'll do start and httpd, it has started now.
Now I will do systemctl status,
and now you'll see that the
status is active and running.
Now let's go to look for the
label SELinux label for that process.
So I'll do ps -axZ, and grep for httpd.
And right here, you'll see it has this entire thing
is the label and the type that I'm saying is
this. This is the type that you could change or
kernel can change if you specify some type of policy.
All right, now let's look at the socket.
netstat -tnlpz,
and grep for httpd.
And again, the socket has the same
label and the type to it.
And this is the type.
[No audio]
All right, so now we talked about already,
how do we check the labels of SELinux
to every file, directory, and program, and sockets.
So let's move on and let's talk
about the commands to manage SELinux settings.
There's a command called semanage to label or change the
label to all of these followings. There is another command chcon
that can be used as well to change labels.
So the labels can be applied to all of
these entities right below login, user, port, interface, module,
node, file context, boolean, permissive state, dontaudit.
I have highlighted boolean in this entire slide.
It's because boolean, I would say, is the one
that is mostly used while you're using SELinux.
Let's talk about boolean.
What is boolean?
Well, boolean is kind of like an on and off switch.
So there are predefined out of the
box boolean that comes with SELinux.
So if you have SELinux installed and
it just started, the boolean is already there.
Now, what is a boolean? Boolean,
as an example, it tells SELinux, hey, do
we allow FTP server to access home directory?
Meaning do we allow FTP user, the user FTP
server when it runs it has a user, right?
FTP user, not just specifically FTP user, but FTP.
Do we allow that user to access the home directories?
Now, if the boolean says on, that means yes.
If the boolean says off, then it means it's off.
It cannot.
You could get a list of boolean, we'll cover that in a minute.
Another example would be can httpd talk
to ldap or any name directory services.
You would have a list of other things too,
like can http talk to send mail, to send
mail or not, whether it's on or off.
So you can make it on or off depending
on your requirement and of course many other booleans.
How to get a list of all booleans.
What do we get when we install Linux?
What do we get out of the box?
To get the list you have to run the command
getsebool and of course -a, a is for all.
Or there's another command that you could get
which is semanage boolean dash list which will
also give you pretty much the same result.
As I said, you should go over every
boolean that you have in your system.
So this way you don't have to create your
own or come up or install on your own.
There are tons of them that SELinux offers you right
off the box. To enable or turn on a boolean.
Now, you have identified this should be
on or this should be off.
Now, how do you enable it or
how do you turn on and off.
Now again, keep in mind this is where we
are making changes only when SELinux is enabled.
Once that is enabled, only then you could
do all those different configuration within SELinux.
Anyway, to turn on the boolean,
you could run the command setsebool -P space
boolean underscore name whichever the name that you will see when
you run the getsebool and of course on for
on, off for off. Check error messages related to SELinux. If
you define anything in your SELinux,
if you set any boolean and there
is an error messages in it,
or if you are running an Apache server
for example and the Apache server supposed to
read a file from a user home directory,
let's say iafzal. You start an Apache server,
and you get an error message that it cannot read
that file, then of course you would go in and
run a command journalctl, journal control.
This command is kind of a log, it keeps track
of everything, every error message that is related to SELinux.
It will tell you hey, the reason you cannot run
that and I've noticed is because Apache server apparently cannot
read the file that you wanted to read that is
located in /home/iafzal directory.
And why is that?
Because you probably have given
everyone to read that file.
Meaning on the other, you have given like r,
to read everyone but still can't read it. Why?
Because as I said, it probably has a label and the
label says that it is only allowed to read for that
only user, so you have to change the label, especially the type
to give it that label to word http.
To change the type in a label you could run the
chcon -t httpd_sys_content_t FILENAME.
If it's a system file, you give that label.
If it's a home directory, you give that home directory label.
You can also run the command,
semanage -t httpd_sys_content_t FILENAME.
So these are the two commands that you
could run to change the labeling of SELinux.
Let me try a few different commands.
Let me clear the screen. To get a list of all booleans, I
getsebool -a. You see, so many of them came up.
Let me try to do more so I'll see one page at a time.
OK cluster_can_network_connect.
Can the cluster connected network, off, no.
Another example daemon_use_tty, no. dhcp_use_ldap
no, off. ftp_use_fusefs, no, off. So FTP
user cannot access the sys and most of them
are disabled or off. httpd_can_connect_ftp server.
Meaning if you go to a web server and
in the web server you probably wanted to give
a functionality to click somewhere and transfer the file.
And the only way to transfer the file
if you have FTP running on your server.
So that is running. All is good, everything is hunky dory, perfect.
But now it's still not working. Why?
Because number one, your SELinux is on.
Number two, the httpd_can_connect_ftp server
is off, so you have to go in and
make it, or turn it on and so on.
There are so many of them.
As I said, you could go into one by one.
And if you really wanted to get yourself familiar with all
of them, you should go through each one of them, read
about it and find out what they are for.
And again, I'm sorry, I cannot go over all of them.
Because if I do, this becomes a course on its own.
And I do not want to waste all those people
time who really don't want to get into details of
SELinux, but they do want to understand how it
works and as a system administrator point of view, can
use SELinux for a regular day to day work.
Anyway, if you want to find out how many booleans
we have, let's say out of the box, you could
do getsebool -a and you could do wc
-l, and you will see there are 110 booleans
that you could actually maintain or manage.
So if you want to set a boolean, so let's say I
wanted to do something with http, so let me do grep http,
this is all with http, what Http
can do and what http cannot.
So let's say I want http to connect to FTP as well.
So first copy this, and right now as you see, it's off.
So before I just do grep, I'll
just grep on that specific one.
It says it's off, right?
We wanted to make it on or turn it on.
So I'll do setsebool -P, boolean, sorry boolean name as we
already know, which is this, and then on, hit Enter.
It could take anywhere from 2 seconds to
10 seconds, depending on your system, of course.
Now, if you want to confirm whether it
turned on or not, what do you do?
You go through the same getsebool,
and you'll see it is on.
Anyway, that is something I just
showed you for the lab purpose.
I'll go ahead and turn it back off
[No audio]
and it should turn it back off.
Now again, getenforce gets you what?
Whether SELinux is enabled or not. If you want to disable
it again, make sure talk to your manager, talk to your
security team, if you want to disable it or not, whether
you wanted to get something out of it. Anyway,
so the point is, if you want to
disable it permanently, you would do vi.
But before I do vi, I said
make sure you take a snapshot.
So I'll make a copy first of all.
/etc/selinux/config to /etc/,
I'll put it in the tmp directory, /tmp/config.orig..
So I made a copy. Good.
Now I will modify /etc/selinux/config file. Come down,
and now I will put a comment on enforcing,
and I will take out SELINUX=disabled.
Now it should disable it.
I will go ahead and save it.
Once I save it, what do I have to do?
When you do getenforce, it will still say enforcing.
For you to make it change globally or to
the system wide, you have to do a reboot.
So let's see, when I reboot
it says server unexpectedly closed.
Now a connection that's fine, that's perfectly fine because I
am using PuTTY. All right, so from this point on
I am going to wait until system comes back online.
So I am going to fast forward from this point.
[No audio]
Okay, so I got the connection back on,
I'm going to close the other window behind
it and now I got a new connection.
[No audio]
I will log in as root.
[No audio]
Now if I do getenforce, it says disabled.
So that's how you could get the
information about whether it's enabled or disabled.
What was the other command that we would need
to run to check whether it's enabled or disabled?
sestatus.
And now it's saying SELinux status is disabled.
So you could run ls -dZ on my home directory,
and it will still show that it has the
label on it because before it had SELinux enabled.
But this whole label, please make sure
this whole label is not enforced.
Right now you can move this spot anywhere and it
will work based on the permissions which is defined here.
And this permission is what, it is
DAC, discretionary Access Control, not through
MAC, which is mandatory access control.
So anyway, this is the whole topic about SELinux.
Again, as I said, there is a lot more
than what I have covered but it gets into
really nifty and green down in the weeds.
So if you wanted to know more about SELinux,
I have included in this section the entire guide,
the configuration administration user guide on SELinux.
So please, I would definitely recommend you to go
over it, read about it, and hopefully you get
all the answers that you're looking for.
[No audio]