{"id":89,"date":"2011-05-05T14:17:16","date_gmt":"2011-05-05T14:17:16","guid":{"rendered":"http:\/\/www.salsaunited.net\/blog\/?p=89"},"modified":"2011-05-05T14:17:16","modified_gmt":"2011-05-05T14:17:16","slug":"selinux-cheat-sheet","status":"publish","type":"post","link":"https:\/\/blog.domb.net\/?p=89","title":{"rendered":"RHEL6 SELinux cheat sheet"},"content":{"rendered":"

Lot of admin turn SELinux off because it looks complicated. Here is a cheat sheet to make your life easier<\/p>\n

Two important documentations about Selinux can be found here:<\/span><\/span><\/p>\n

http:\/\/docs.redhat.com\/docs\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Security-Enhanced_Linux\/index.html<\/span><\/span><\/strong><\/span><\/p>\n

http:\/\/docs.redhat.com\/docs\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Managing_Confined_Services\/index.html<\/span><\/span><\/strong><\/span><\/p>\n

—————————————————————————–<\/p>\n

If you work on Centos or Redhat, install the following packages on your system: <\/span><\/span><\/em><\/p>\n

setroubleshoot.noarch<\/span><\/span><\/strong> : Helps troubleshoot SELinux problems<\/span><\/span><\/p>\n

setroubleshoot-plugins.noarch<\/span><\/span><\/strong> : Analysis plugins for use with setroubleshoot<\/span><\/span><\/p>\n

setroubleshoot-server.noarch<\/span><\/span><\/strong> : SELinux troubleshoot server<\/span><\/span><\/p>\n

[root@client1 ~]# <\/span><\/span>yum install setroubleshoot<\/span><\/span><\/strong><\/p>\n

Start the setroubleshootd daemon:<\/span><\/span><\/em><\/p>\n

[root@client1 ~]#<\/span><\/span>setroubleshootd<\/span><\/span><\/strong><\/p>\n

—————————————————————————–<\/p>\n

Get the status of selinux:<\/span><\/span><\/em><\/p>\n

[root@client1 ~]#<\/span><\/span>sestatus<\/span><\/span><\/strong><\/p>\n

SELinux status: enabled<\/span><\/span><\/p>\n

SELinuxfs mount: \/selinux<\/span><\/span><\/p>\n

Current mode: enforcing<\/span><\/span><\/p>\n

Mode from config file: enforcing<\/span><\/span><\/p>\n

Policy version: 21<\/span><\/span><\/p>\n

Policy from config file: targeted<\/span><\/span><\/p>\n

Check for permissive or enforcing mode: <\/span><\/span><\/em><\/p>\n

[root@client1 ~]#<\/span><\/span>getenforce<\/span><\/span><\/strong><\/p>\n

If you get back a <\/span><\/span>1<\/span><\/span><\/strong> selinux is turned on if you get back a <\/span><\/span>0<\/span><\/span><\/strong> its turned off.<\/span><\/span><\/p>\n

Switch selinux modes from permissive to enforcing and back: <\/span><\/span><\/em><\/p>\n

[root@client1 ~]#<\/span><\/span>setenforce 1<\/span><\/span><\/strong> (will set enforcing mode)<\/span><\/span><\/p>\n

[root@client1 ~]#<\/span><\/span>setenforce 0<\/span><\/span><\/strong> (will set permissive mode)<\/span><\/span><\/p>\n

—————————————————————————–<\/p>\n

Selinux AVC Log files: <\/span><\/span><\/em><\/p>\n

All selinux logs can be found in <\/span><\/span>\/var\/log\/audit\/audit.log<\/span><\/span><\/strong><\/p>\n

SELinux logfiles looks very crytpy without the tool sealert. Here an extract of the log without and with the command sealert:<\/span><\/span><\/p>\n

[root@client1 ~]#<\/span><\/span>less \/var\/log\/audit\/audit.log<\/span><\/span><\/strong><\/p>\n

type=DAEMON_START msg=audit(1304542876.396:4843): auditd start, ver=1.7.18 format=raw kernel=2.6.18-238.el5 auid=4294967295 pid=2553 subj=system_u:system_r:auditd_t:s0 res=success<\/span><\/span><\/p>\n

type=CONFIG_CHANGE msg=audit(1304542876.570:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1<\/span><\/span><\/p>\n

[root@client1 ~]# <\/span><\/span>sealert -a \/var\/log\/audit\/audit.log | less<\/span><\/span><\/strong><\/p>\n

found 1 alerts in \/var\/log\/audit\/audit.log<\/span><\/span><\/p>\n

——————————————————————————–<\/span><\/span><\/p>\n

Summary:<\/span><\/span><\/p>\n

SELinux is preventing nagios (nagios_t) “getattr” to \/var\/nagios\/objects.cache<\/span><\/span><\/p>\n

(var_t).<\/span><\/span><\/p>\n

Detailed Description:<\/span><\/span><\/p>\n

[SELinux is in permissive mode, the operation would have been denied but was<\/span><\/span><\/p>\n

permitted due to permissive mode.]<\/span><\/span><\/p>\n

SELinux denied access requested by nagios. It is not expected that this access<\/span><\/span><\/p>\n

is required by nagios and this access may signal an intrusion attempt. It is<\/span><\/span><\/p>\n

also possible that the specific version or configuration of the application is<\/span><\/span><\/p>\n

causing it to require additional access.<\/span><\/span><\/p>\n

Allowing Access:<\/span><\/span><\/p>\n

Sometimes labeling problems can cause SELinux denials. You could try to restore<\/span><\/span><\/p>\n

the default system file context for \/var\/nagios\/objects.cache,<\/span><\/span><\/p>\n

restorecon -v ‘\/var\/nagios\/objects.cache’<\/span><\/span><\/p>\n

If this does not work, there is currently no automatic way to allow this access.<\/span><\/span><\/p>\n

Instead, you can generate a local policy module to allow this access – see FAQ<\/span><\/span><\/p>\n

(http:\/\/fedora.redhat.com\/docs\/selinux-faq-fc5\/#id2961385) Or you can disable<\/span><\/span><\/p>\n

SELinux protection altogether. Disabling SELinux protection is not recommended.<\/span><\/span><\/p>\n

Please file a bug report (http:\/\/bugzilla.redhat.com\/bugzilla\/enter_bug.cgi)<\/span><\/span><\/p>\n

against this package.<\/span><\/span><\/p>\n

—————————————————————————–<\/p>\n

SELinux bool variables: <\/span><\/span><\/em><\/p>\n

Each service has its own ruleset. The Selinux bools can be found with the command getsebool<\/span><\/span><\/p>\n

Here and example for the httpd service<\/span><\/span><\/p>\n

[root@client1 ~]# <\/span><\/span>getsebool -a | grep httpd <\/span><\/span><\/strong><\/p>\n

allow_httpd_anon_write –> off<\/span><\/span><\/p>\n

allow_httpd_sys_script_anon_write –> off<\/span><\/span><\/p>\n

httpd_builtin_scripting –> on<\/span><\/span><\/p>\n

httpd_can_network_connect –> off<\/span><\/span><\/p>\n

httpd_can_network_connect_db –> off<\/span><\/span><\/p>\n

httpd_can_network_relay –> off<\/span><\/span><\/p>\n

httpd_can_sendmail –> on<\/span><\/span><\/p>\n

If you would start the apache server you would not be able to connect to it, because the <\/span><\/span>httpd_can_network_connect<\/span><\/span><\/strong> is turned <\/span><\/span>off. <\/span><\/span><\/strong><\/p>\n

Set sebool to on:<\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span>setsebool -P httpd_can_network_connect =on<\/span><\/span><\/strong><\/p>\n

Now you are able to start the apache server and connect to it.<\/span><\/span><\/p>\n

Selinux Manpage
\n<\/span><\/span><\/p>\n

[root@client1 ~]#man httpd_selinux <\/strong><\/p>\n

—————————————————————————–<\/p>\n

Restore default security context of files or directories (File labeling): <\/em><\/p>\n

Check filecontext:<\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span>ls -Z<\/span><\/span><\/strong><\/p>\n

drwxr-xr-x root root root:object_r:httpd_sys_content_t nagvis<\/span><\/span><\/p>\n

drwxr-xr-x root root root:object_r:httpd_sys_content_t nconf<\/span><\/span><\/p>\n

[root@client1 ~]# <\/span><\/span>restorecon -v \/var\/www\/html\/index.html <\/span><\/span><\/span><\/strong><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>restorecon -Rv \/var\/www\/html\/index.html<\/span><\/span><\/span><\/strong> <\/span><\/span><\/span><\/p>\n

To check if a restore is needed: <\/span><\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>restorecon -Rv -n \/var\/www\/html<\/span><\/span><\/span><\/strong><\/p>\n

Set new security context not persistent: <\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>chcon -Rv \u2013type=httpd_sys_content_t \/html<\/span><\/span><\/span><\/strong><\/p>\n

Set new security context not persistent:<\/span><\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>semanage fcontext -a -t httpd_sys_content_t \u201c\/html(\/.*)?\u201d<\/span><\/span><\/span><\/strong><\/p>\n

—————————————————————————–<\/p>\n

Open non standard ports for httpd service:<\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>semanage port -a -t http_port_t \u2013 p tcp 81<\/span><\/span><\/span><\/strong><\/p>\n

List all the ports managed permitted by selinux<\/span><\/span><\/span><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>semanage port -l<\/span><\/span><\/span><\/strong><\/p>\n

—————————————————————————–<\/p>\n

Create selinux rule:<\/span><\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>grep security_context_t \/var\/log\/audit\/audit.log | audit2allow -m nagios1 > nagios.te<\/span><\/span><\/strong><\/p>\n

now review the rules in the .te file.<\/span><\/span><\/p>\n

Create selinux module: <\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>grep security_context_t \/var\/log\/audit\/audit.log | audit2allow -M nagios1<\/span><\/span><\/span><\/strong><\/p>\n

Install the module:<\/span><\/span><\/span><\/em><\/p>\n

[root@client1 ~]# <\/span><\/span><\/span>semodule -i nagios1.pp<\/span><\/span><\/span><\/strong><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Lot of admin turn SELinux off because it looks complicated. Here is a cheat sheet to make your life easier Two important documentations about Selinux can be found here: http:\/\/docs.redhat.com\/docs\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Security-Enhanced_Linux\/index.html http:\/\/docs.redhat.com\/docs\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Managing_Confined_Services\/index.html —————————————————————————– If you work on Centos or Redhat, install the following packages on your system: setroubleshoot.noarch : Helps troubleshoot SELinux problems setroubleshoot-plugins.noarch : Analysis…<\/p>\n","protected":false},"author":1,"featured_media":161,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-89","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/89","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=89"}],"version-history":[{"count":0,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/161"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}