SELinux - Revision history

Johayek at 15:14, 27 September 2022

2022-09-27T15:14:01Z

← Older revision		Revision as of 15:14, 27 September 2022
Line 28:		Line 28:
	root@… $ setenforce [Enforcing\|Permissive\|1\|0]		root@… $ setenforce [Enforcing\|Permissive\|1\|0]
	root@… $ getenforce		root@… $ getenforce
			root@… $ sestatus
	</pre>		</pre>

Johayek at 15:01, 27 September 2022

2022-09-27T15:01:32Z

@@ Line 19: / Line 19: @@
 * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#selinux-states-and-modes_getting-started-with-selinux
 * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#changing-selinux-states-and-modes_using-selinux
 == context of a file ==

Johayek at 11:33, 20 September 2022

2022-09-20T11:33:03Z

← Older revision		Revision as of 11:33, 20 September 2022
Line 45:		Line 45:
	What "ll -Z" (resp. "ll --context") in addition to what "ll" usually displays, is called:		What "ll -Z" (resp. "ll --context") in addition to what "ll" usually displays, is called:
	* a SELinux_USER_CONTEXT (unconfined_u) -> "semanage fcontext --modify --seuser"		* a SELinux_USER_CONTEXT (unconfined_u) -> "semanage fcontext --modify --seuser"
	* a ~~role~~ (object_r)		* a ROLE (object_r)
	* a TYPE_CONTEXT (user_home_t) -> "semanage fcontext --modify --type"		* a TYPE_CONTEXT (user_home_t) -> "semanage fcontext --modify --type"
	* a level AKA RANGE (s0) -> "semanage fcontext "		* a level AKA RANGE (s0) -> "semanage fcontext "

			CAVEAT: chcon does not work well with restorecon. restorecon effectively restores the old context.

	<pre>		<pre>
			root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --role ROLE --type TYPE_CONTEXT /usr/local/foo.txt
	root@… $ chcon --no-dereference --user SELinux_USER_CONTEXT --role ROLE --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt		root@… $ chcon --no-dereference --user SELinux_USER_CONTEXT --role ROLE --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt
	~~root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt~~

	root@… $ restorecon -vF /usr/local/foo.txt # -v for ''verbose'', -F for ''force reset''		root@… $ restorecon -vF /usr/local/foo.txt # -v for ''verbose'', -F for ''force reset''
Line 59:		Line 61:

	<pre>		<pre>
			root@… $ semanage fcontext --add/--modify --seuser system_u --role object_ --type systemd_unit_file_t /usr/lib/systemd/system/tomcat.service
	root@… $ chcon --no-dereference --user system_u --role object_r --type systemd_unit_file_t --range s0 /usr/lib/systemd/system/tomcat.service		root@… $ chcon --no-dereference --user system_u --role object_r --type systemd_unit_file_t --range s0 /usr/lib/systemd/system/tomcat.service
	~~root@… $ semanage fcontext --add/--modify --seuser system_u --type systemd_unit_file_t --range s0 /usr/lib/systemd/system/tomcat.service~~

	root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service		root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service

Johayek at 11:15, 20 September 2022

2022-09-20T11:15:26Z

← Older revision		Revision as of 11:15, 20 September 2022
Line 56:		Line 56:
	</pre>		</pre>

	So usually for a systemd service file you would execute these 2 command lines:		So usually for a systemd service file you would execute these 2 resp.3 command lines:

	<pre>		<pre>

Johayek at 11:15, 20 September 2022

2022-09-20T11:15:01Z

← Older revision		Revision as of 11:15, 20 September 2022
Line 52:		Line 52:
	root@… $ chcon --no-dereference --user SELinux_USER_CONTEXT --role ROLE --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt		root@… $ chcon --no-dereference --user SELinux_USER_CONTEXT --role ROLE --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt
	root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt		root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt

	root@… $ restorecon -vF /usr/local/foo.txt # -v for ''verbose'', -F for ''force reset''		root@… $ restorecon -vF /usr/local/foo.txt # -v for ''verbose'', -F for ''force reset''
	</pre>		</pre>
Line 58:		Line 59:

	<pre>		<pre>
	root@… $ semanage fcontext --add/--modify --seuser system_u --type systemd_unit_file_t /usr/lib/systemd/system/tomcat.service		root@… $ chcon --no-dereference --user system_u --role object_r --type systemd_unit_file_t --range s0 /usr/lib/systemd/system/tomcat.service
			root@… $ semanage fcontext --add/--modify --seuser system_u --type systemd_unit_file_t --range s0 /usr/lib/systemd/system/tomcat.service

	root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service		root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service
	</pre>		</pre>

Johayek at 11:07, 20 September 2022

2022-09-20T11:07:33Z

← Older revision		Revision as of 11:07, 20 September 2022
Line 19:		Line 19:
	* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#selinux-states-and-modes_getting-started-with-selinux		* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#selinux-states-and-modes_getting-started-with-selinux
	* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#changing-selinux-states-and-modes_using-selinux		* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#changing-selinux-states-and-modes_using-selinux

			== context of a file ==

			* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-working_with_selinux-selinux_contexts_labeling_files
			* https://www.man7.org/linux/man-pages/man8/semanage.8.html
			* https://www.man7.org/linux/man-pages/man8/semanage-fcontext.8.html
			* http://www.freekb.net/Article?id=1418 !!!!!
			* https://www.gnu.org/software/coreutils/manual/html_node/chcon-invocation.html – Change SELinux context of file

	So far my usual approach for getting the SELinux context of a file right is:		So far my usual approach for getting the SELinux context of a file right is:
	<pre>		<pre>
	# find a file with the right context! ("FILE_WITH_RIGHT_CONTEXT")		# find a file with the right context! ("FILE_WITH_RIGHT_CONTEXT")
	$ ll -Z FILE_WITH_RIGHT_CONTEXT		$ ll --context FILE_WITH_RIGHT_CONTEXT
	# rename the file, whose context isn't right, to FILE- or so!		# rename the file, whose context isn't right, to FILE- or so!
	$ mv FILE FILE-		$ mv FILE FILE-
Line 35:		Line 43:
	</pre>		</pre>

	* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-working_with_selinux-selinux_contexts_labeling_files		What "ll -Z" (resp. "ll --context") in addition to what "ll" usually displays, is called:
			* a SELinux_USER_CONTEXT (unconfined_u) -> "semanage fcontext --modify --seuser"
	What "ll -Z" in addition to what "ll" usually displays, is called:
	* a SELinux_USER_CONTEXT (unconfined_u) -> --seuser
	* a role (object_r)		* a role (object_r)
	* a TYPE_CONTEXT (user_home_t) -> --type		* a TYPE_CONTEXT (user_home_t) -> "semanage fcontext --modify --type"
	* a level (s0)		* a level AKA RANGE (s0) -> "semanage fcontext "

	<pre>		<pre>
	root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --type TYPE_CONTEXT /usr/local/foo.txt		root@… $ chcon --no-dereference --user SELinux_USER_CONTEXT --role ROLE --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt
	root@… $ restorecon -vF /usr/local/foo.txt		root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --type TYPE_CONTEXT --range RANGE /usr/local/foo.txt
			root@… $ restorecon -vF /usr/local/foo.txt # -v for ''verbose'', -F for ''force reset''
	</pre>		</pre>

	So usually for a systemd service file you would execute these 2 command lines		So usually for a systemd service file you would execute these 2 command lines:
	~~(derived from http://www.freekb.net/Article?id=1418)~~:

	<pre>		<pre>
	root@… $ semanage fcontext --add/--modify --seuser system_u --type systemd_unit_file_t /usr/lib/systemd/system/tomcat.service		root@… $ semanage fcontext --add/--modify --seuser system_u --type systemd_unit_file_t /usr/lib/systemd/system/tomcat.service
	root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service ~~# -v for ''verbose'', -F for ''force reset''~~		root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service
	</pre>		</pre>

Johayek at 13:34, 7 September 2022

2022-09-07T13:34:06Z

← Older revision		Revision as of 13:34, 7 September 2022
Line 3:		Line 3:
	* http://www.freekb.net/Article?id=1418 – SELinux - Change context of a file or directory (chcon restorecon semanage) !!!!!		* http://www.freekb.net/Article?id=1418 – SELinux - Change context of a file or directory (chcon restorecon semanage) !!!!!
	* http://www.freekb.net/Article?id=1169 – SELinux - Determine context of a file or directory		* http://www.freekb.net/Article?id=1169 – SELinux - Determine context of a file or directory

			* https://www.man7.org/linux/man-pages/man8/semanage.8.html
			* https://www.man7.org/linux/man-pages/man8/semanage-fcontext.8.html
			* https://www.man7.org/linux/man-pages/man8/restorecon.8.html

	learning.oreilly.com :		learning.oreilly.com :
Line 34:		Line 38:

	What "ll -Z" in addition to what "ll" usually displays, is called:		What "ll -Z" in addition to what "ll" usually displays, is called:
	* a ~~USER_CONTEXT~~ (unconfined_u)		* a SELinux_USER_CONTEXT (unconfined_u) -> --seuser
	* a role (object_r)		* a role (object_r)
	* a TYPE_CONTEXT (user_home_t)		* a TYPE_CONTEXT (user_home_t) -> --type
	* a level (s0)		* a level (s0)

	<pre>		<pre>
	root@… $ semanage fcontext -a -~~s USER_CONTEXT~~ -t TYPE_CONTEXT /usr/local/foo.txt		root@… $ semanage fcontext --add/--modify --seuser SELinux_USER_CONTEXT --type TYPE_CONTEXT /usr/local/foo.txt
	root@… $ restorecon -vF /usr/local/foo.txt		root@… $ restorecon -vF /usr/local/foo.txt
	</pre>		</pre>

	So usually for a systemd service file you would execute these 2 command lines:		So usually for a systemd service file you would execute these 2 command lines
			(derived from http://www.freekb.net/Article?id=1418):

	<pre>		<pre>
	root@… $ semanage fcontext -a -s system_u -t systemd_unit_file_t /usr/lib/systemd/system/tomcat.service		root@… $ semanage fcontext --add/--modify --seuser system_u --type systemd_unit_file_t /usr/lib/systemd/system/tomcat.service
	root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service		root@… $ restorecon -vF /usr/lib/systemd/system/tomcat.service # -v for ''verbose'', -F for ''force reset''
	</pre>		</pre>

Johayek at 12:59, 7 September 2022

2022-09-07T12:59:29Z

@@ Line 1: / Line 1: @@
 * https://en.wikipedia.org/wiki/Security-Enhanced_Linux
 * https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf
 learning.oreilly.com :
@@ Line 13: / Line 15: @@
 * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#selinux-states-and-modes_getting-started-with-selinux
 * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#changing-selinux-states-and-modes_using-selinux

Johayek: Created page with "* https://en.wikipedia.org/wiki/Security-Enhanced_Linux * https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf learning.oreilly.com : * https://learni..."

2022-07-21T09:25:36Z

Created page with "* https://en.wikipedia.org/wiki/Security-Enhanced_Linux * https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf learning.oreilly.com : * https://learni..."

New page

* https://en.wikipedia.org/wiki/Security-Enhanced_Linux
* https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf

learning.oreilly.com :
* https://learning.oreilly.com/topics/selinux/
* https://learning.oreilly.com/library/view/selinux-system-administration/9781800201477/
* https://learning.oreilly.com/library/view/selinux-cookbook/9781783989669/

access.redhat.com :
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/changing-selinux-states-and-modes_using-selinux
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#selinux-states-and-modes_getting-started-with-selinux
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/using_selinux/index#changing-selinux-states-and-modes_using-selinux