SELinux Flashcards
Check the current SELinux state:
getenforce
There are 3 states in SELinux:
disabled, permissive, and enforcing
How to change the state of SELinux:
setenforce {Permissive or 0, Enforcing or 1}
Where are the SELinux logs?
/var/log/audit/audit.log
How to search the logs?
grep AVC /var/log/audit/audit.log
or
sealert -a /var/log/audit/audit.log
(Access Vector Cache)
SELinux Overview
SELinux is essentially labeling, called security contexts
All processes, files, and directories have security contexts. All files and directories in inherit a default security context.
SELinux is a type enforcement system
SELinux messages for allowing or denying are cached as Access Vector Cach(AVC)
SELinux Messages Contain?
scontext = source context of the process tcontext = target context of the process
Two packages to install to help troubleshoot SELinux
yum install policycoreutils-gui setroubleshoot
File that contains the state of SELinux?
/etc/selinux/config
To see the man pages related to SELinux?
apropos selinux
man -k selinux
to view the secuirty context on a file or directory?
ls -Z /etc/
The security context is broken down into three components
User:Role:Type
User- refers to the type of user logged in
Role- Which indicates the purpose of this file
View the security context for a running process
ps auZ
Reference a files security context and transfer it to another file:
chcon –reference /root/anaconda-ks.cfg /etc/ssh/sshdconfig
To restore the default security context ?
restorecon -R /root/.ssh
How to set the security context manually?
chcon -t etc_t /etc/ssh/sshd_config (will not survive a system relablel)
How to make a manual security context change persistent?
semanage fcontext -a -t etc_t “/etc/ssh/sshd_config”
semanage fcontext -a -t httpd_sys_content_t “/web(/.*)?”
To see a complete list of SELinux booleans?
semanage boolean -l | less
Set SE booleans related to a specify service?
getsebool -a | grep ftp
To set a boolean
setsebool -P ftp ftp_home_dir on
Get the status of SELinux
sestatus
Look at the man for semanage examples
man semanage-fcontext
search the audit log
ausearch -m avc
To see the default type context
semanage fcontext -l
semanage fcontext -l | grep httpd
Relabel SELinux
touch /.autorelabel
Change the default type context in selinux
semanage fcontext -a -t http_sys_content_t ‘/content(/.*)?’
- a = add
- t = type
Restore the context recursively
restorecon -Rv /content
Delete the context
semanage fcontext -d “/content(/.*)?”
list the available boolean values on the system
getsebool -a
Look at all the default boolean values
semanage boolean -l
To find out what package you need to install to use semanage
yum whatprovides semanage
Package you need to install to use sealert
yum install -y setroubleshoot-server
