SELinux (Security advanced Linux)

 

What is SELinux?

Security enhanced Linux is the linux kernel security module that provides a mechanism for supporting access control security policies. including mandatory access controls.

It is the project of united states national security Agency and SElinux Community.

>>>>>>>>>>≥>>>>>>>>>>>

SELinux Options:

Enforcing: Enabled (enabledby default in redhat centos, Fedora)

Permissive: disabled but logs the activity.

Disable: disabled and not the activity logs.

>>>>>>>>>>>>>>>>>>>≥>>>>>>>>>>>>>

how to check the SElinux status?

#sestatus or getenforce

• SElinux setting:

#setenforce 0 = permissive/disable

# setenforce 1 = enable

but these changes are temporary. Once the server reboots, these settings will flush.

>>>>>>>>>>>>≥>>>>>>>>>>>>>>>

• Modify SELinux config file for permanent setting:

 # /etc/selinux/config

and make the following changes:

SELINUX = enforcing. if you want to enable SELINUX. 

SELINUX = disabled. if you want to disable SELINUX.

>>>>>>>>>>>>>>>>>>>>>>>

• before modifying selinux config file:

#create the snapshot of the VM and create the copy of the config file.

• Two main concepts of SElinux:

#Labelling: labelling has 4 parts = user: role: type: level

#Type Enforcement

>>>>>>>>>>>>>>>>>>>>>>>>>>>>

To list the label of the file:

#ls  -lZ /usr/sbin/httpd

•to list the label of the directory:

#ls -lZ /etc/httpd

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

• As the webserver runs its process is labelled in memory as httpd_t:

# ps axZ | grep httpd

• SELinux assigns the label at socket level:

#netstat  -tnlpZ | grep http

• To get the list of all booleans:

# getsebool -a

# semanage boolean  -l

• To enable or turn on a booleans

#setsebool -P boolean_name on

• check the error messages related to selinux:

#journalctl

•to change the type in a label:

#chcon  -t   httpd_sys_content_t   filename

Or

#semanage  -t  httpd_sys_content_t  filename

• to check if httpd can connect to ftp or not?

# getsebool -a | grep httpd_can_connect_ftp

•to set the value to ON for httpd_can_connect_ftp

#setsebool  -P  httpd_can_connect_ftp  on