{"id":535,"date":"2018-04-10T09:10:10","date_gmt":"2018-04-10T09:10:10","guid":{"rendered":"http:\/\/shijuvarghese.com\/?p=535"},"modified":"2018-04-10T12:47:28","modified_gmt":"2018-04-10T12:47:28","slug":"selinux-security","status":"publish","type":"post","link":"http:\/\/shijuvarghese.com\/?p=535","title":{"rendered":"SELinux Security"},"content":{"rendered":"

SELinux is a set of security rules using which we can control the processes that can access specific files, folders and ports. These processes, files, folders and ports has a special security label called SELinux context<\/strong>. The label called context can be:
\n(1) user
\n(2) role
\n(3) type
\n(4) sensitivity.<\/p>\n

The SELinux policy<\/strong> determines if a process can access a files, folders or port. By default the SELinux policy blocks all access to files, folders and ports.<\/p>\n

The default policy enabled in RHEL\/CentOS called “targeted policy<\/strong>” bases its rules on the 3rd context which is the “type<\/strong>” context, which usually ends with “_t<\/strong>“.<\/p>\n

If we take example of a Apache web service, the httpd process usually access the folders “\/var\/ww\/html<\/em>“, “\/var\/tmp<\/em>“, “\/tmp<\/em>“, etc. The type<\/strong> context associated with httpd service is “httpd_t<\/strong>“. The Type context associated with the folder “\/var\/ww\/html” is “httpd_sys_content_t<\/strong>“, the port is “http_port_t<\/strong>“, etc.<\/p>\n

The SELinux context can be displayed when using commands such as ps, ls, cp, mkdir<\/strong>. etc by using the “-Z<\/strong>” switch. For example:<\/p>\n

[root@shiju-test ~]# ps -axZ | grep http<\/strong><\/em>
\nsystem_u:system_r:httpd_t:s0 11675 ? Ss 0:00 \/usr\/sbin\/httpd -DFOREGROUND
\nsystem_u:system_r:httpd_t:s0 11676 ? S 0:00 \/usr\/sbin\/httpd -DFOREGROUND<\/p>\n

[root@shiju-test ~]# ls -Z \/var\/www<\/strong><\/em>
\ndrwxr-xr-x. root root system_u:object_r:httpd_sys_script_exec_t:s0 cgi-bin
\ndrwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 html<\/p>\n

SELinux can be configured in three modes:<\/p>\n