Managing SELinux Security - RHCSA (RH134).pdf

Slides on how to manage SELinux security - Part of RHCSA (RH134) syllabus

1. Managing SELinux Security

2. SELinux
●SELinux: Linux kernel security module

●Enforces access control policies

●Implements mandatory access controls
(MAC)

●Regulates access to system resources with
fine-grained permissions.

3. ●Apache compromise alone doesn't access user home directories
●SELinux rules must be configured for Apache to access user home files when
compromised

4. Options in SELinux
1. Enforcing Mode: Actively enforces access control policies

2. Permissive Mode: Logs policy violations without
enforcement

3. Disabled Mode: No access control or security enforcement

Note - The /etc/selinux/config file stores configuration
settings for SELinux.

5. Commands
●To check which option is enabled in SELinux.
Command: sestatus








Command : getenforce

6. Change SELinux option
●Change to permissive / disable from enforcing
Command: setenforce 0






●Change to enforcing from permissive / disable
Command : setenforce 1

7. ●To permanently modify SELinux configuration , make change in
/etc/selinux/config file :
○From enforcing to disabled
■SELINUX=disabled

○From disabled to enforcing
■SELINUX=enforcing




Note: Disabling SELinux can compromise system security; always
have a backup or create a /.autorelabel file before rebooting.

8. SELinux main concepts
1.Labeling: Assigns security
labels to system resources,
determining their access
permissions

2.Type Enforcement: Controls
access based on the security
context of objects and subjects,
ensuring policy compliance

9. Labeling commands
●List all the labels for each file in a directory
Command: ls -lZ /etc/ssh







●List the labels of a directory
Command : ls -dZ /etc/ssh

10. ● SELinux assigns labels at socket level
Command: netstat –tnlpZ | grep ssh





●SSH processes labeled in memory by SELinux
Command : ps axZ | grep sshd

11. ● To change a type of a file or directory in label
Command: chcon -t httpd_sys_content_t /etc/ssh





●To restore it back to its original type
Command : restorecon -v /etc/ssh && ls -dZ /etc/ssh

12. SELinux Booleans
SELinux booleans are binary values that toggle specific system
behaviors and permissions
●Get list of all booleans
Command: getsebool -a

13. ●Semanage with boolean -l is also use to list all booleans
Command : semanage boolean -l

14. ●To set boolean to yes
Command : setsebool -P ssh_use_tcpd 1





●To set boolean to yes
Command : setsebool -P ssh_use_tcpd 0