What's new with SELinux in RHEL7
Daniel J Walsh
Senior Principal Software Engineer
@rhatdan, danwalsh.livejournal.com, dwalsh@redhat.com
Thursday Oct 3 2013
Domains?
735 total domain
71 unconfined domains
disable unconfine.pp module (semodule -d unconfined)
11 unconfined domains
New Confined Domains (156)
New Confined Domains (156)
Removed Confined Domains (72)
Shrinking Policy Size RHEL6
# seinfo Statistics for policy file: /etc/selinux/targeted/policy/policy.24 Policy Version & Type: v.24 (binary, mls) Classes: 81 Permissions: 235 Sensitivities: 1 Categories: 1024 Types: 3620 Attributes: 280 Users: 9 Roles: 12 Booleans: 205 Cond. Expr.: 241 Allow: 299690 Neverallow: 0 Auditallow: 116 Dontaudit: 220788 Type_trans: 30779 Type_change: 38 Type_member: 48 Role allow: 20 Role_trans: 308 Range_trans: 4521 Constraints: 90 Validatetrans: 0 Initial SIDs: 27 Fs_use: 22 Genfscon: 83 Portcon: 434 Netifcon: 0 Nodecon: 0 Permissives: 73 Polcap: 2
Shrinking Policy Size RHEL7
# seinfo Statistics for policy file: /sys/fs/selinux/policy Policy Version & Type: v.28 (binary, mls) Classes: 83 Permissions: 253 Sensitivities: 1 Categories: 1024 Types: 4264 Attributes: 353 Users: 10 Roles: 15 Booleans: 263 Cond. Expr.: 314 Allow: 86854 Neverallow: 0 Auditallow: 12 Dontaudit: 8096 Type_trans: 13806 Type_change: 80 Type_member: 35 Role allow: 34 Role_trans: 735 Range_trans: 4846 Constraints: 97 Validatetrans: 0 Initial SIDs: 27 Fs_use: 25 Genfscon: 91 Portcon: 524 Netifcon: 1 Nodecon: 1 Permissives: 8 Polcap: 2
Shrinking Policy Size
RHEL6
du /etc/selinux/targeted/policy/policy.24 7116 /etc/selinux/targeted/policy/policy.24
RHEL7
du /etc/selinux/targeted/policy/policy.29 2652 /etc/selinux/targeted/policy/policy.29
Systemd SELinux Integration
systemd will start all daemons now. transitions to all init domains.
systemd can impersonate domains, for start on demand
systemd SELinux access manager
Is NetworkManager_t allowed to start dhclient_t? httpd_t?
File Transitions
In RHEL6 there were three ways for a file object to get a label on creation.
1. Labeled the same as its containing directory.
2. Program could use SELinux API to request label.
3. File Transitions.
Process Labeled A Creating a File Object in a Directory labeled B will get label C.
File Transitions
Process needs to create two files objects in same directory with different labels?
mkdir /root/.ssh
In RHEL6 admin must run restorecon -r -v /root/.ssh
Or sshd will not be allowed to read content.
File Name Transitions
In RHEL7 we will have 4th mechanism.
File Name Transitions
policy writer can write
If process labeled A creates File Object in Directory B with the name FOOBAR, create FOOBAR with the label C.
type_transition unconfined_t admin_home_t : dir ssh_home_t ".ssh";
In RHEL7 an admin typing mkdir /root/.ssh will automatically get the correct label!!!
Type_trans: 13806
sepolicy tool chain
booleans - Description of booleans
communicate - Can domains communicate with each other
generate - Generate SELinux Policy module template
interface - See SELinux Policy interfaces
manpage - Generate SELinux man pages
network - See network information
transition - See how domain can transition to the target domain
sepolicy GUI
gui - New Application Centric Graphical User Interface
sepolicy Demonstration
SELinux and Containers
http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/openshift_selinux.ogvIf a file object is mislabeled you will get errors?
Someone put Skittles in the M&M dispenser!!!
Classic SELinux issue
vi ~/index.html
sudo mv ~/index.html /var/www/html
# wget localhost --2013-08-08 11:33:24-- http://localhost/ Resolving localhost (localhost)... ::1, 127.0.0.1 Connecting to localhost (localhost)|::1|:80... connected. HTTP request sent, awaiting response... 403 Forbidden 2013-08-08 11:33:24 ERROR 403: Forbidden.
How we currently diagnose
tail -1 /var/log/httpd/error_log [Thu Aug 08 11:33] Permission denied: AH00132: file permissions deny server access: /var/www/html/index.html
Maybe SELinux?
kernel sends message to audit daemon.
auditd writes message to /var/log/audit/audit.log
ausearch -m avc -ts recent
----
time->Thu Aug 8 11:33:24 2013
type=PATH msg=audit(1375976004.652:1042): name="/var/www/html/index.html"
inode=3145858 dev=08:03 mode=0100644 ouid=0 ogid=0 rdev=00:00
obj=unconfined_u:object_r:user_home_t:s0
type=CWD msg=audit(1375976004.652:1042): cwd="/"
type=AVC msg=audit(1375976004.652:1042): avc: denied { read } pid=23276
comm="httpd" name="index.html" dev="sda3" ino=3145858
scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
Setroubleshootd
writes message in /var/log/message
Aug 08 11:43:47 redsox setroubleshoot[24241]: SELinux is preventing /usr/sbin/httpd from read access on the file /var/www/html/index.html. For complete SELinux messages. run sealert -l fd6b9022-1ced-4065-905a-8f0e884f9915
writes analysys in /var/lib/setroubleshoot/setroubleshoot_database.xml
sealert
sealert -l fd6b9022-1ced-4065-905a-8f0e884f9915 SELinux is preventing /usr/sbin/httpd from read access on the file /var/www/html/index.html. ***** Plugin restorecon (92.2 confidence) suggests ************************ If you want to fix the label. /var/www/html/index.html default label should be httpd_sys_content_t. Then you can run restorecon. Do # /sbin/restorecon -v /var/www/html/index.html ...
System writes information all over the place
/var/log/httpd/error_log
/var/log/audit/audit.log
/var/log/messages
/var/lib/setroubleshoot/setroubleshoot_database.xml
SETroubleshoot integration with journald
type=AVC msg=audit(1375976004.652:1042): avc: denied { read } pid=23276
comm="httpd" name="index.html" dev="sda3" ino=3145858
scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
Journald now allows privileged logging tools to reference other processes by PID
SETroubleshoot integration with journald
systemctl status httpd
# systemctl status -l httpd
httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
Active: active (running) since Thu 2013-08-08 11:33:15 EDT; 45min ago
Main PID: 23272 (httpd)
Status: "Total requests: 4; Current requests/sec: 0; ..."
CGroup: /system.slice/httpd.service
...
Aug 08 11:33:15 redsox systemd[1]: Started The Apache HTTP Server.
Aug 08 11:33:23 redsox python[23287]: SELinux is preventing /usr/sbin/httpd
from read access on the file /var/www/html/index.html.
***** Plugin restorecon (
Secure Linux Containers
Labeled NFS
https://access.redhat.com/site/videos/214723
IDM/FreeIPA supports SELinux Confined Users
At login sssd contacts FreeIPA for user@machine
Downloads /etc/selinux/targeted/logins
cat dwalsh sshd:staff_u:s0-s0:c0.c1023 *:guest_u:s0-s0:c0.c1023
sudo be configured by IPA with SELinux Config
dwalsh ALL=(ALL) TYPE=webadm_t ROLE=webadm_r ALL
Confined Users
Active Directory
being worked on
Future RHEL7?
New coreutils
mv -Z
cp -Z
install -Z
mkdir -Z
Future
Friendly EPERM
questions?
