So in order to do its work, SELinux uses labels.
And I'm just going to show you how it works.
If you want to see SELinux label information,
you need the minus Z option.
So I'm going to use PSZAUX, PipeGrep, HTTP.
And there we can see in the first column the security
label, also known as the context label.
It consists of four components, of which
only the third component is relevant for RHCSA.
System U and system R, that's the user
and a role that's only for advanced SELinux
configuration.
Don't worry about it.
You won't see it in RHCSA.
And in 99.9% of all systems that use SELinux, it's not used.
Likewise for the S0.
What matters is the context type, as we call it.
As you can see for these HTTPD processes,
the context type is set to HTTPD underscore T.
Now let's explore the web server document route.
In var www, we have two subdirectories.
And these subdirectories are first HTML.
And as you can see, there we have a context type as well
And the context type is HTTPD underscore sys,
underscore content, underscore T.
Now how does it work?
In SELinux, you have the policy.
And in the policy, there are rules
that define what is allowed.
And the SELinux policy has a rule
that allows the source, HTTPD underscore T,
to access the target, HTTPD sys content T.
And this target, HTTPD sys content T,
contains all the permissions that are allowed in there.
Now what is nice is that we can also see CGI bin.
This is a directory where you can put scripts
that are executable by the Apache web server.
And these scripts are in a directory
that has HTTPD sys script exact T.
And by the name of this context label,
you can already guess that the context label
allows the user to execute scripts.
Now can you imagine what is going to happen
if a user tries to run a script from HTTPD sys content T?
That's right, SELinux will deny.
AVC denied is the message that you will find later
when we are going to explore this.
Now back to the story that I was just telling you.
How about the var tmp directory?
Well, when I use ls minus ldz on var tmp,
there we can see that this directory
has the context type tmp underscore T.
Now how does that work?
Well, in the case of the hack that I just described,
from an SELinux perspective,
there would be a request coming from HTTPD underscore T,
targeting tmp underscore T.
And SELinux would check its rules
to see if there is a rule that allows access
to this var tmp directory.
And most likely that rule does not exist
because HTTPD underscore T has no business writing
or running files in this directory.
And for that reason, in my example,
we would have seen AVC denied
if it would have been an SELinux secured system.
And that is the essence of the working of SELinux.