In this lesson, we'll explore Se Linux context applied to files and processes.
We saw that Linux supports some rudimentary forms of access control
files and directories have permissions that establish who can read,
write or execute content.
Also, regular users are not allowed to do certain things that the root user can do.
But these forms of security are not enough
for today's world of sophisticated cyber attacks.
They're just too generic, not finetuned enough
and a simple read or write permission gives a user or
process too much power over a particular area of the system.
Fortunately,
the Linux kernel can be easily extended with so-called
modules and there's a security module called Se Linux
that adds a very advanced capabilities of restricting access.
Now,
Se Linux is preconfigured and enabled by default
on operating systems from the red hat family,
but it's not enabled by default on a
boon to
and the initial configuration on a boon two can be a bit tricky,
but we'll take a deeper look at Se Linux and
Ubuntu in one of our next sessions
for. Now, let's see how this Linux security module works at a surface level.
Se Linux allows for very fine grained control
of what actions should be allowed or denied.
Now, how does it make such decisions?
We saw how command like LS dash L shows us
what permissions are enabled or disabled for a file or directory
in output like this, we can tell from the string RW dash, rw dash R dash dash,
how permissions are set for this file?
Se Linux employs a similar mechanism just like
we can see permissions for files and directories.
With the dash L option,
we can use a different option to see Se Linux file directory labels.
And we do that by passing the dash Z option to our LS command
and we'll see output like this.
Now, this part is called the Se Linux context
and it's also sometimes just called a label because at a file system level,
this is simply a label applied to the file,
just some additional metadata glued on top of it.
And by looking at the label,
Se Linux can decide what the security context is for
this file and what kind of actions it should allow.
Although these vaguely resemble file directory permissions,
they're much more complex.
So let's take a quick look at what this context tells us.
First, these context components are always displayed in this order,
user
raw
Tate
and level.
So in our case, the unconfined underscore U is the user
object underscore R is the role
user underscore home underscore T is the type and
zero is the level
to allow or deny some action.
Se Linux roughly follows this logic first, it looks at the user part of the label.
This is not the same as the username you log in with. It's an Se Linux user.
Every user who logs into a Linux system is mapped to an
Se Linux user as a part of the Se Linux policy configuration.
After the user is identified, a decision is made to see if it can assume the role,
each user can only assume a predefined set of roles.
For example,
we can imagine how a developer underscore U user should
only be able to enter roles like developer underscore R
or Docker underscore R that allow them to read and
write application code and launch containers and so on.
But they should not be able to enter roles
like sysadmin underscore R that let them change system settings
if the role can be entered.
Next, the check is performed to see if this role can transition to the type.
The name of this field comes from type enforcement.
This type is like a protective software jail.
Once something enters the type enforcement defined here,
it can only do certain things and nothing else.
The fourth part, the level is almost never actively used on regular systems.
That's a better fit for complex organizations
that require multiple levels of security.
An example of this imagine Jane is a high ranking military officer,
she has a high clearance level and will be able to read documents classified
from level zero to level four with level four being top secret files.
On the other hand,
a user with level one access can only access stuff on level one and level zero,
but access to anything above level one is restricted.
So we notice how we can basically go from user to
roll to type to enter into some kind of restricted secure box
going through this three
step path. Se Linux achieves three important things.
It makes sure that only certain users can enter certain roles and certain types.
So it keeps unauthorized users and processes from entering
types or domains that are not for them.
It lets authorized users and processes do their
job by granting the permissions they need.
However, at the same time,
even authorized users and processes are allowed to
take only a limited set of actions.
Everything else is denied.
Why is this important? Here's one example,
it can protect against the hijacked program.
Now imagine a hacker takes control of the Apache program
that serves up web pages to our website visitors.
Even though the malicious user now controls the program,
he or she is still restricted by Se Linux.
The hijacked Apache application is confined to a
certain security domain applied to that process.
So it can only take actions allowed for that security domain.
Hence, the hacker isn't able to step out of those boundaries.
The attacker is effectively in a virtual jail.
And the damage that can be done is greatly reduced.
And usually the most important part of Se Linux context is the type slash domain.
The third part in our label here.
And since we mentioned processes also get context like files,
how do we explore what se Linux contexts are applied to them
with the same slash Z option?
To see all processes, we use the PSAX command
and to add security labels to the output. We add the Z option like this
and we can see our SSH daemon running here and spot that
it's restricted to the SSH D underscore T type enforcement domain.
This domain contains a strict set of policies that
define what this process is allowed to do.
Also important to note
not anything can enter the SSH underscore T domain
in the default systemwide Selinux policy only
files that have the SSH D underscore exec
underscore Tse Linux
type in their label can enter this domain.
And sure enough, if we check the file containing the SSH D program,
we'll see that it's indeed labeled with this type.
Now to recap only a file marked with a certain type
can enter a process that can shift into a certain domain.
This type establishes permitted actions for a file.
The domain establishes permitted actions for a process.
Now back to the output of our Psaxz command.
Anything labeled with unconfirmed underscore T is running unrestricted.
Se Linux lets those processes do almost anything they want
back to the output of our Psaxz command.
Anything labeled with unconfined underscore T is running unrestricted.
Se Linux lets those processes do almost anything they want.
Here are some other useful commands we can use.
Se Linux puts a security bubble around everything, even a user,
not just a file or a process
to see the security context assigned to our current user.
What got applied to our user. When we logged in, we can run ID dash
Z.
When we log in the user, we log in as is automatically mapped to an Se Linux user.
To see how this mapping is done,
we can use this command
output.
Like this means that when the root user logs in,
they'll be mapped to the Se Linux user called unconfined underscore U.
If any other user logs in that's not defined in this list,
they'll be mapped to whatever we see on
the underscore underscore default underscore underscore line.
In this case, also unconfined underscore U we can see that by default.
Se Linux doesn't initially restrict the user in any way.
Since they transition to this unconfined user
on most systems,
it's usually the role and type components of
a context that start to restrict access.
But for advanced use cases,
things can be set up so that restrictions begin at the user level
only if we see enforcing here.
It means that it's doing its job and denying unauthorized actions.
Permissive means it's allowing everything.
It's just logging actions that should have been restricted,
but it's not actively denying anything.
Finally, if we see disabled here, it means that Se Linux is not doing anything.
It isn't enforcing security and it isn't even logging.