Section 20.195 SELinux Policies

Question 1

SELinux and MAC Basics

SELinux (Security Enhanced Linux)

Answer 1

● A security mechanism that provides an additional layer of security for
Linux distributions

● Enforces Mandatory Access Control (MAC)

Question 2

SELinux and MAC Basics

Mandatory Access Control (MAC)

Answer 2

Restricts access to system resources based on subject clearance and
object labels

Question 3

SELinux and MAC Basics

Context-based permissions

Answer 3

Permission schemes that consider various properties to determine
whether to grant or deny access to a user

■ Two main context-based permission schemes in Linux that use MAC:

● SELinux
● AppArmor

Question 4

SELinux and MAC Basics

DAC vs. MAC

Answer 4

DAC (Discretionary Access Control):

○ Each object has a list of entities that are allowed to access it
○ Allows object owners to directly control access using tools like
‘chown’ and ‘chmod’

● SELinux relies on MAC for permissions and access control, not DAC

Question 5

SELinux

Answer 5

The default context-based permission scheme in CentOS and Red Hat Enterprise Linux created by NSA

■ Used to enforce MAC on processes and resources
■ Enables information to be classified and protected
■ Enhances file system and network security, preventing unauthorized access, security breaches, and execution of untrustworthy programs

Question 6

Three Main Contexts in SELinux

User Context

Answer 6

Defines which users can access an object, including common contexts like
‘unconfined_u,’ (ALL USERS)
‘user_u,’ (UNPRIVILEGED USERS)
‘sysadm_u,’ (SYSTEM ADMINISTRATORS)
‘root’ (ROOT USER)

Question 7

Three Main Contexts in SELinux

Role Context

Answer 7

Determines which roles can access an object, using ‘object_r’ for files and
directories

Question 8

Three Main Contexts in SELinux

Type Context

Answer 8

Essential for fine-grained access control, grouping objects with similar
security characteristics

Question 9

Optional Context (4th context)

Level Context

Answer 9

● Describes the sensitivity level of a file, directory, or process

● Known as a multi-level security context, allowing further access control refinement

Question 10

3 SELinux Modes

Disabled Mode

Answer 10

Turns off SELinux, relying on default DAC for access control

Question 11

3 SELinux Modes

Enforcing Mode

Answer 11

Enforces all SELinux security policies, preventing policy violations

Question 12

3 SELinux Modes

Permissive Mode

Answer 12

Enables SELinux but doesn’t enforce policies, allowing processes to
bypass security policies

Question 13

SELinux Policies

SELinux Policy

Answer 13

Describes access permissions for users, programs, processes, files, and devices

Question 14

SELinux Policies: Two Main Policy Types

Targeted Policies

Answer 14

Only specific processes are confined to a domain, while others run unconfined

Question 15

SELinux Policies: Two Main Policy Types

Strict Policies

Answer 15

Every subject and object operates under MAC, but it’s more
complex to set up

Question 16

Violation Messages

Answer 16

SELinux captures violation messages in an audit log

■ Violations can occur when someone tries to access an unauthorized object, or an
action contradicts an existing policy

Question 17

Policy Configuration

Answer 17

Initial SELinux setup may result in false violations, requiring policy tweaking and fine-tuning

■ Strong security depends on creating effective restricted profiles and hardening applications to prevent malicious attacks