Hello, and a very big welcome to you and this module, Implementing SELinux.
My name is Andrew Mallett,
and I'm your Pluralsight instructor that's going to
guide you through this module,
the module where we're going to be taking a look at what SELinux is.
We're going to be able to understand the different
SELinux modes and which mode we should use.
We'll look at how we can read and change our modes.
We might also want to install additional tools for SELinux, giving us more
power over the management of our policies. In understanding SELinux, we have
to be able to understand the SELinux label and how we can read that from
things like our processes from our files.
We'll also see inside of the label we have something called type, and
type enforcement is the default method for managing SELinux. We'll
see how we can change file contexts and how the file context affects
who can access that directory.
We also can restore contexts.
So if we've made an erroneous change, we can go through, based on our policy,
restore the correct context for that directory and files within that directory.
If things are going wrong, where we're not allowed to do something
through SELinux, we might want to see why that has been flagged as a
violation and what we can do to correct it.
So we're going to look at how we can use the ausearch utility to be
able to search our audit log for our SELinux violations and make
suggestions as to what we can do to fix it.
First of all,
SELinux. SELinux itself is a mandatory access control list,
unlike things like our file permissions,
which are discretionary access control lists.
So it means that things like the root user is able to
ignore our access control lists,
but a mandatory access control list is different.
It was originally developed by the NSA, and now has been run by
the NSA and Red Hat as a combination or partnership. It's been
part of Red Hat Enterprise Linux since the very early days, since
Red Hat Enterprise Linux 4.
So by the time we get into Red Hat Enterprise Linux 8 and the rebuilds of that,
we are at something at quite a maturity level.
Now the real importance of SELinux is that many of your services are going to
run with root access. Using SELinux, we're able to control the access that
even the root account has through to your system.
Now when we look at understanding security, we're never really that bothered
about modifying our file system security. We just accept that when setting up
new directories, we're probably going to have to set up the correct permissions
so our users and groups have the correct level of access. It's the same sort of
thing when we're dealing with firewalls. We're never really too bothered about
having to add in firewall rules to allow access to services that sit behind that
firewall. And we should treat SELinux in the same way. Many people then will say,
well, it didn't work for me out of the box,
although, to be honest, many of the default settings will work for you, it's
just when you need to do something out of the ordinary,
changing the location of a directory,
changing the port that a service might run on,
then you're going to have to adjust our SELinux rules to allow that to
happen, much in the same way that we allow file system rules to be
changed and we allow firewall rules to be changed.
It needs to be adjusted. Now the first thing that we need to look at as far as
SELinux is concerned is the three operating modes that it has. Its first and
default is enforcing, as the name suggests. Then all of the SELinux rules that
we have are both enforced, and any violations are logged through to the audit
log. If we're having problems,
one thing that we can do is set SELinux into permissive mode. So
in this case there is no rule enforcement,
we won't stop things happening, but we will log the
violations, and that's really important.
It gives you an idea of what needs to be fixed on the system so you
can be fully compliant and enforcing the rules.
The third and final mode is disabled, and really this is not a good idea and
not recommended. This is there where SELinux is not operational, so there is
no logging and, of course, no rule enforcement. Now there's a couple of bad
things about this. With no logging,
we don't know what the current state of our system is,
how compliant or noncompliant we are with the SELinux rules and what
might need to be done to make sure that our system is running more
secure, so it's bad from that point of view.
Now the other really bad thing is that SELinux is not
operational, and this means that any file context within our
file system is not going to be properly maintained and
monitored. On changing them back later on,
maybe from disabled to enforcing, on a reboot, we're going to
have to go through and check every single file in the file system
to see if it has the correct context.
Now that might take 2 minutes, but it might take 2 hours. So it's not
an easy migration from disabled into your enforcing or permissive
mode, whereas it's a relatively simple check whilst you're in
permissive mode to check the violations,
fix up all of those errors, and then migrate into enforcing.
Now at this stage, we're going to dive through to our
command line so we can understand a little bit about reading and changing our modes in SELinux.