We're going to take a look now at our type enforcement.
This is the default policy with SELinux.
And as we've kind of got a flavor of so far,
the source type must be compatible with the target SELinux type.
What we mean by that is that there must be an explicit
rule within our SELinux policy that allows the source to
be able to access the target.
Now this then is going to work pretty much for us out of the box,
but if we need to start changing the location of directories or if we need
to start using different port numbers on our services,
we're certainly going to have to consider making some changes.
We can list our context using the uppercase Z.
So if we're using ls to look at the file system, we can use the uppercase Z.
If we're looking at processes, we can use ps ‑Z.
So generally,
we're going to be looking at the SELinux context by using the uppercase Z.
The main thing that we are concerned with with type enforcement
is looking at the type of the SELinux context.
When we look at the shadow file, the type is shadow_t.
And when we look at our processes that we are seeing,
here we've got bash and the ps command,
they are not related to anything in particular so they're unconfined_t.
When we take a look say at a little more detail at our shadow file,
we can elevate our privileges,
we can go through and take a look at our shadow file.
If we, though,
become maybe a little bit mischievous or just want to see what happens,
we can change the type with chcon, change context,
‑t for the type.
And if we put it for admin_home_t for our shadow file,
this will essentially break anything relating to
authentication or even listing aging information.
So here when we try and use chage command ‑l to take a look at our vagrant user,
we're going to be unable to list the information because the
process that is being generated by chage is not going to be
authorized to access the target admin_home_t.
We have a little bit of a problem, Houston.
We can go through and use our ausearch to try and understand the problem.
If we use our timestamp, ‑ts recent,
we're only going to see information within the last 10 minutes,
which is great.
We could also go through and if we've installed the setroubleshoot process,
setroubleshoot would take our messages out of our audit
log and put them inside of messages.
It will then give me an sealert that I can go through and search for.
It will give me the alert‑id, so don't worry about that,
you will see it in your var/log/messages,
and it can give you some suggestions on what to do if you need to fix the issue.
So great for your troubleshooting.
If we go through and restore the context,
we actually look at the policy and see what the context should be,
our SELinux context including the type for our shadow file.
If we put the ‑v switch on, we can see it changing from one type to another.
Now we've looked at it a little bit in our slides,
but, as always,
the best way to learn is to dive out to your own systems and see this in action.
But be very careful when we are changing the context on the shadow file.
Make sure that it is literally a play system that you're working with,
as it's potentially you could be permanently damaging your system if
you're unable to get the context set back carefully.
So this is a big warning. Do this only on your play systems, not on important systems.