| Managing Confined ServicesFrom the MySQL project page: "The MySQL® database has become the world's most popular open source database because of its consistent fast performance, high reliability and ease of use. It's used on every continent -- Yes, even Antarctica! -- by individual Web developers as well as many of the world's largest and fastest-growing organizations to save time and money powering their high-volume Web sites, business-critical systems and packaged software -- including industry leaders such as Yahoo!, Alcatel-Lucent, Google, Nokia, YouTube, and Zappos.com." In Red Hat Enterprise Linux, the mysql-server package provides MySQL. Run rpm -q mysql-server to see if the mysql-server package is installed. If it is not installed, run the following command as the root user to install it: yum install mysql-server When MySQL is enabled, it runs confined by default. Confined processes run in their own domains, and are separated from other confined processes. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited. The following example demonstrates the MySQL processes running in their own domain. This example assumes the mysql package is installed: Run getenforce to confirm SELinux is running in enforcing mode: $ getenforceEnforcing The getenforce command returns Enforcing when SELinux is running in enforcing mode. Run service mysqld start as the root user to start mysqld: # service mysqld startInitializing MySQL database: Installing MySQL system tables... [ OK ]Starting MySQL: [ OK ] Run ps -eZ | grep mysqld to view the mysqld processes: $ ps -eZ | grep mysqldunconfined_u:system_r:mysqld_safe_t:s0 6035 pts/1 00:00:00 mysqld_safeunconfined_u:system_r:mysqld_t:s0 6123 pts/1 00:00:00 mysqld The SELinux context associated with the mysqld processes is unconfined_u:system_r:mysqld_t:s0. The second last part of the context, mysqld_t, is the type. A type defines a domain for processes and a type for files. In this case, the mysqld processes are running in the mysqld_t domain.
Type Enforcement is the main permission control used in SELinux targeted policy. All files and processes are labeled with a type: types define a domain for processes and a type for files. SELinux policy rules define how types access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it. The following types are used with mysql. Different types allow you to configure flexible access: mysqld_db_tThis type is used for the location of the MySQL database. In Red Hat Enterprise Linux, the default location for the database is /var/lib/mysql, however this can be changed. If the location for the MySQL database is changed, the new location must be labeled with this type. Refer to the following example for instructions on how to change the default database location and how to label the new section appropriately. mysqld_etc_tThis type is used for the MySQL main configuration file /etc/my.cnf and any other configuration files in the /etc/mysql directory. mysqld_exec_tThis type is used for the mysqld binary located at /usr/libexec/mysqld, which is the default location for the MySQL binary on Red Hat Enterprise Linux. Other systems may locate this binary at /usr/sbin/mysqld which should also be labeled with this type. mysqld_initrc_exec_tThis type is used for the initialization file for MySQL, located at /etc/rc.d/init.d/mysqld by default in Red Hat Enterprise Linux. mysqld_log_tLogs for MySQL need to be labeled with this type for proper operation. All log files in /var/log/ matching the mysql.* wildcard must be labeled with this type. mysqld_var_run_tThis type is used by files in /var/run/mysqld, specifically the process id (PID) named /var/run/mysqld/mysqld.pid which is created by the mysqld daemon when it runs. This type is also used for related socket files such as /var/lib/mysql/mysql.sock. Files such as these must be labeled correctly for proper operation as a confined service.
SELinux is based on the least level of access required for a service to run. Services can be run in a variety of ways; therefore, you must tell SELinux how you are running services. The following Boolean allows you to tell SELinux how you are running MySQL: allow_user_mysql_connectWhen enabled, this Boolean allows users to connect to MySQL. exim_can_connect_dbWhen enabled, this Boolean allows the exim mailer to initiate connections to a database server. ftpd_connect_dbWhen enabled, this Boolean allows ftp daemons to initiate connections to a database server. httpd_can_network_connect_dbEnabling this Boolean is required for a web server to communicate with a database server.
10.4. Configuration Examples10.4.1. MySQL Changing Database LocationWhen using Red Hat Enterprise Linux 6, the default location for MySQL to store its database is /var/lib/mysql. This is where SELinux expects it to be by default, and hence this area is already labeled appropriately for you, using the mysqld_db_t type. The location where the database is stored can be changed depending on individual environment requirements or preferences, however it is important that SELinux is aware of this new location - that it is labeled accordingly. This example explains how to change the location of a MySQL database and then how to label the new location so that SELinux can still provide its protection mechanisms to the new area based on its contents. Note that this is an example only and demonstrates how SELinux can affect MySQL. Comprehensive documentation of MySQL is beyond the scope of this document. Refer to the official MySQL documentation for further details. This example assumes that the mysql-server and setroubleshoot-server packages are installed, that the auditd service is running, and that there is a valid database in the default location of /var/lib/mysql. Run ls -lZ /var/lib/mysql to view the SELinux context of the default database location for mysql: # ls -lZ /var/lib/mysqldrwx------. mysql mysql unconfined_u:object_r:mysqld_db_t:s0 mysql This shows mysqld_db_t which is the default context element for the location of database files. This context will have to be manually applied to the new database location that will be used in this example in order for it to function properly. Enter mysqlshow -u root -p and enter the mysqld root password to show the available databases: # mysqlshow -u root -pEnter password: *******+--------------------+| Databases |+--------------------+| information_schema || mysql || test || wikidb |+--------------------+ Shut down the mysqld daemon with service mysqld stop as the root user: # service mysqld stopStopping MySQL: [ OK ] Create a new directory for the new location of the database(s). In this example, /mysql is used: # mkdir -p /mysql Copy the database files from the old location to the new location: # cp -R /var/lib/mysql/* /mysql/ Change the ownership of this location to allow access by the mysql user and group. This sets the traditional Unix permissions which SELinux will still observe. # chown -R mysql:mysql /mysql Run ls -lZ /opt to see the initial context of the new directory: # ls -lZ /optdrwxr-xr-x. mysql mysql unconfined_u:object_r:usr_t:s0 mysql The context usr_t of this newly created directory is not currently suitable to SELinux as a location for MySQL database files. Once the context has been changed, MySQL will be able to function properly in this area. Open the main MySQL configuration file /etc/my.cnf with a text editor and modify the datadir option so that it refers to the new location. In this example the value that should be entered is /mysql. [mysqld]datadir=/mysql Save this file and exit. Run service mysqld start as the root user to start mysqld. The service should fail to start, and a denial will be logged to the /var/log/messages file. However, if the audit daemon is running and with him the setroubleshoot service, the denial will be logged to the /var/log/audit/audit.log file instead: SELinux is preventing /usr/libexec/mysqld "write" access on /mysql. For complete SELinux messages. run sealert -l b3f01aff-7fa6-4ebe-ad46-abaef6f8ad71 The reason for this denial is that /mysql is not labeled correctly for MySQL data files. SELinux is stopping MySQL from having access to the content labeled as usr_t. Perform the following steps to resolve this problem: Run the following semanage command to add a context mapping for /mysql. Note that semanage is not installed by default. If it missing on your system, install the policycoreutils-python package. semanage fcontext -a -t mysqld_db_t "/mysql(/.*)?" This mapping is written to the /etc/selinux/targeted/contexts/files/file_contexts.local file: # grep -i mysql /etc/selinux/targeted/contexts/files/file_contexts.local/mysql(/.*)? system_u:object_r:mysqld_db_t:s0 Now use the restorecon command to apply this context mapping to the running system: restorecon -R -v /mysql Now that the /mysql location has been labeled with the correct context for MySQL, the mysqld daemon starts: # service mysqld startStarting MySQL: [ OK ] Confirm the context has changed for /mysql: ls -lZ /optdrwxr-xr-x. mysql mysql system_u:object_r:mysqld_db_t:s0 mysql The location has been changed and labeled, and the mysqld daemon has started successfully. At this point all running services should be tested to confirm normal operation.
"PostgreSQL is a powerful, open source object-relational database system. It has more than 15 years of active development and a proven architecture that has earned it a strong reputation for reliability, data integrity, and correctness." In Red Hat Enterprise Linux 6, the postgresql-server package provides PostgreSQL. Run rpm -q postgresql-server to see if the postgresql-server package is installed. If it is not installed, run the following command as the root user to install it: yum install postgresql-server 11.1. PostgreSQL and SELinuxWhen PostgreSQL is enabled, it runs confined by default. Confined processes run in their own domains, and are separated from other confined processes. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited. The following example demonstrates the PostgreSQL processes running in their own domain. This example assumes the postgresql-server package is installed: Run getenforce to confirm SELinux is running in enforcing mode: $ getenforceEnforcing The getenforce command returns Enforcing when SELinux is running in enforcing mode. Run service postgresql start as the root user to start postgresql: service postgresql startStarting postgresql service: [ OK ] Run ps -eZ | grep postgres to view the postgresql processes: ps -eZ | grep postgresunconfined_u:system_r:postgresql_t:s0 395 ? 00:00:00 postmasterunconfined_u:system_r:postgresql_t:s0 397 ? 00:00:00 postmasterunconfined_u:system_r:postgresql_t:s0 399 ? 00:00:00 postmasterunconfined_u:system_r:postgresql_t:s0 400 ? 00:00:00 postmasterunconfined_u:system_r:postgresql_t:s0 401 ? 00:00:00 postmasterunconfined_u:system_r:postgresql_t:s0 402 ? 00:00:00 postmaster The SELinux context associated with the postgresql processes is unconfined_u:system_r:postgresql_t:s0. The second last part of the context, postgresql_t, is the type. A type defines a domain for processes and a type for files. In this case, the postgresql processes are running in the postgresql_t domain.
Type Enforcement is the main permission control used in SELinux targeted policy. All files and processes are labeled with a type: types define a domain for processes and a type for files. SELinux policy rules define how types access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it. The following types are used with postgresql. Different types allow you to configure flexible access: postgresql_db_tThis type is used for several locations. The locations labeled with this type are used for data files for PostgreSQL: postgresql_etc_tThis type is used for configuration files in /etc/postgresql. postgresql_exec_tThis type is used for several locations. The locations labeled with this type are used for binaries for PostgreSQL: /usr/bin/initdb(.sepgsql)?
/usr/bin/(se)?postgres
/usr/lib(64)?/postgresql/bin/.*
/usr/lib/phsql/test/regress/pg_regress
postgresql_initrc_exec_tThis type is used for the PostgreSQL initialization file located at /etc/rc.d/init.d/postgresql. postgresql_log_tThis type is used for several locations. The locations labeled with this type are used for log files: /var/lib/pgsql/logfile
/var/lib/pgsql/pgstartup.log
/var/lib/sepgsql/pgstartup.log
/var/log/postgresql
/var/log/postgres.log.*
/var/log/rhdb/rhdb
/var/log/sepostgresql.log.*
postgresql_var_run_tThis type is used for run-time files for PostgreSQL, such as the process id (PID) in /var/run/postgresql.
SELinux is based on the least level of access required for a service to run. Services can be run in a variety of ways; therefore, you must tell SELinux how you are running services. The following Boolean allows you to tell SELinux how you are running PostgreSQL: allow_user_postgresql_connectHaving this Boolean enabled allows any user domain (as defined by PostgreSQL) to make connections to the database server.
11.4. Configuration Examples11.4.1. PostgreSQL Changing Database LocationWhen using Red Hat Enterprise Linux 6, the default location for PostgreSQL to store its database is /var/lib/pgsql/data. This is where SELinux expects it to be by default, and hence this area is already labeled appropriately for you, using the postgresql_db_t type. The area where the database is located can be changed depending on individual environment requirements or preferences, however it is important that SELinux is aware of this new location - that it is labeled accordingly. This example explains how to change the location of a PostgreSQL database and then how to label the new location so that SELinux can still provide its protection mechanisms to the new area based on its contents. Note that this is an example only and demonstrates how SELinux can affect PostgreSQL. Comprehensive documentation of PostgreSQL is beyond the scope of this document. Refer to the official PostgreSQL documentation for further details. This example assumes that the postgresql-server package is installed. Run ls -lZ /var/lib/pgsql to view the SELinux context of the default database location for postgresql: # ls -lZ /var/lib/pgsqldrwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 data This shows postgresql_db_t which is the default context element for the location of database files. This context will have to be manually applied to the new database location that will be used in this example in order for it to function properly. Create a new directory for the new location of the database(s). In this example, /opt/postgresql/data is used. If you use a different location, replace the text in the following steps with your location: # mkdir -p /opt/postgresql/data Perform a directory listing of the new location. Note that the initial context of the new directory is usr_t. This context is not sufficient for SELinux to offer its protection mechanisms to PostgreSQL. Once the context has been changed, it will be able to function properly in the new area. # ls -lZ /opt/postgresql/drwxr-xr-x. root root unconfined_u:object_r:usr_t:s0 data Change the ownership of the new location to allow access by the postgres user and group. This sets the traditional Unix permissions which SELinux will still observe. # chown -R postgres:postgres /opt/postgresql Open the PostgreSQL init file /etc/rc.d/init.d/postgresql with a text editor and modify the PGDATA and PGLOG variables to point to the new location: # vi /etc/rc.d/init.d/postgresqlPGDATA=/opt/postgresql/dataPGLOG=/opt/postgresql/data/pgstartup.log Save this file and exit the text editor. Initialize the database in the new location. su - postgres -c "initdb -D /opt/postgresql/data" Having changed the database location, starting the service will fail at this point: # service postgresql startStarting postgresql service: [FAILED] SELinux has caused the service to not start. This is because the new location is not properly labelled. The following steps explain how to label the new location (/opt/postgresql) and start the postgresql service properly: Run the semanage command to add a context mapping for /opt/postgresql and any other directories/files within it: semanage fcontext -a -t postgresql_db_t "/opt/postgresql(/.*)?" This mapping is written to the /etc/selinux/targeted/contexts/files/file_contexts.local file: # grep -i postgresql /etc/selinux/targeted/contexts/files/file_contexts.local/opt/postgresql(/.*)? system_u:object_r:postgresql_db_t:s0 Now use the restorecon command to apply this context mapping to the running system: restorecon -R -v /opt/postgresql Now that the /opt/postgresql location has been labeled with the correct context for PostgreSQL, the postgresql service will start successfully: # service postgresql startStarting postgreSQL service: [ OK ] Confirm the context is correct for /opt/postgresql: ls -lZ /optdrwxr-xr-x. root root system_u:object_r:postgresql_db_t:s0 postgresql Check with the ps command that the postgresql process displays the new location: # ps aux | grep -i postmasterpostgres 21564 0.3 0.3 42308 4032 ? S 10:13 0:00 /usr/bin/postmaster -p 5432 -D /opt/postgresql/data The location has been changed and labeled, and the postgresql daemon has started successfully. At this point all running services should be tested to confirm normal operation.
From the Rsync project page: "rsync is an open source utility that provides fast incremental file transfer." When using Red Hat Enterprise Linux, the rsync package provides rsync. Run rpm -q rsync to see if the rsync package is installed. If it is not installed, run the following command as the root user to install it: yum install rsync From the Red Hat Enterprise Linux 6 SELinux rsync_selinux(8) man page: "SELinux requires files to have an extended attribute to define the file type. Policy governs the access daemons have to these files. If you want to share files using the rsync daemon, you must label the files and directories public_content_t." Like most services, correct labeling is required for SELinux to perform its protection mechanisms over rsync. Type Enforcement is the main permission control used in SELinux targeted policy. All files and processes are labeled with a type: types define a domain for processes and a type for files. SELinux policy rules define how types access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it. The following types are used with rsync. Different types all you to configure flexible access: public_content_tThis is a generic type used for the location of files (and the actual files) to be shared via rsync. If a special directory is created to house files to be shared with rsync, the directory and its contents need to have this label applied to them. rsync_exec_tThis type is used for the /usr/bin/rsync system binary. rsync_log_tThis type is used for the rsync log file, located at /var/log/rsync.log by default. To change the location of the file rsync logs to, use the --log-file=FILE option to the rsync command at run-time. rsync_var_run_tThis type is used for the rsyncd lock file, located at /var/run/rsyncd.lock. This lock file is used by the rsync server to manage connection limits. rsync_data_tThis type is used for files and directories which you want to use as rsync domains and isolate them from the access scope of other services. Also, the public_content_t is a general SELinux context type which can be used when a file/directory with interacts with multiple services (for example, FTP and NFS directory as an rsync domain). rsync_etc_tThis type is used for rsync-related files in the /etc/ directory.
SELinux is based on the least level of access required for a service to run. Services can be run in a variety of ways; therefore, you must tell SELinux how you are running services. The following Booleans allow you to tell SELinux how you are running rsync: allow_rsync_anon_writeHaving this Boolean enabled allows rsync in the rsync_t domain to manage files, links and directories that have a type of public_content_rw_t. Often these are public files used for public file transfer services. Files and directories must be labeled public_content_rw_t. rsync_clientHaving this Boolean enabled aloows rsync to initiate connections to ports defined as rsync_port_t, as well as allowing rsync to manage files, links and directories that have a type of rsync_data_t. Note that the rsync daemon must be in the rsync_t domain in order for SELinux to enact its control over rsync. The configuration example in this chapter demonstrates rsync running in the rsync_t domain. rsync_export_all_roHaving this Boolean enabled allows rsync in the rsync_t domain to export NFS and CIFS file systems with read-only access to clients.
12.4. Configuration Examples12.4.1. Rsync as a daemonWhen using Red Hat Enterprise Linux, rsync can be used as a daemon so that multiple clients can directly communicate with it as a central server, in order to house centralized files and keep them synchronized. The following example will demonstrate running rsync as a daemon over a network socket in the correct domain, and how SELinux expects this daemon to be running on a pre-defined (in SELinux policy) TCP port. This example will then show how to modify SELinux policy to allow the rsync daemon to run normally on a non-standard port. This example will be performed on a single system to demonstrate SELinux policy and its control over local daemons and processes. Note that this is an example only and demonstrates how SELinux can affect rsync. Comprehensive documentation of rsync is beyond the scope of this document. Refer to the official rsync documentation for further details. This example assumes that the rsync, setroubleshoot-server and audit packages are installed, that the SELinux targeted policy is used and that SELinux is running in enforcing mode. Getting rsync to launch as rsync_t Run getenforce to confirm SELinux is running in enforcing mode: $ getenforceEnforcing The getenforce command returns Enforcing when SELinux is running in enforcing mode. Run the which command to confirm that the rsync binary is in the system path: $ which rsync/usr/bin/rsync When running rsync as a daemon, a configuration file should be used and saved as /etc/rsyncd.conf. Note that the following configuration file used in this example is very simple and is not indicative of all the possible options that are available, rather it is just enough to demonstrate the rsync daemon: log file = /var/log/rsync.logpid file = /var/run/rsyncd.pidlock file = /var/run/rsync.lock[files] path = /srv/files comment = file area read only = falsetimeout = 300 Now that a simple configuration file exists for rsync to operate in daemon mode, this step demonstrates that simply running rsync --daemon is not sufficient for SELinux to offer its protection over rsync. Refer to the following output: # rsync --daemon# ps x | grep rsync 8231 ? Ss 0:00 rsync --daemon 8233 pts/3 S+ 0:00 grep rsync# ps -eZ | grep rsyncunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 8231 ? 00:00:00 rsync Note that in the output from the final ps command, the context shows the rsync daemon running in the unconfined_t domain. This indicates that rsync has not transitioned to the rsync_t domain as it was launched by the rsync --daemon command. At this point SELinux can not enforce its rules and policy over this daemon. Refer to the following steps to see how to fix this problem. In the following steps, rsync will transition to the rsync_t domain by launching it from a properly-labeled init script. Only then can SELinux and its protection mechanisms have an effect over rsync. This rsync process should be killed before proceeding to the next step. A custom init script for rsync is needed for this step. Save the following to /etc/rc.d/init.d/rsyncd. #!/bin/bash# Source function library.. /etc/rc.d/init.d/functions[ -f /usr/bin/rsync ] || exit 0case "$1" instart)action "Starting rsyncd: " /usr/bin/rsync --daemon;stop)action "Stopping rsyncd: " killall rsync;*)echo "Usage: rsyncd {start|stop}"exit 1esacexit 0The following steps show how to label this script as initrc_exec_t: Run the semanage command to add a context mapping for /etc/rc.d/init.d/rsyncd: semanage fcontext -a -t initrc_exec_t "/etc/rc.d/init.d/rsyncd" This mapping is written to the /etc/selinux/targeted/contexts/files/file_contexts.local file: # grep rsync /etc/selinux/targeted/contexts/files/file_contexts.local/etc/rc.d/init.d/rsyncd system_u:object_r:initrc_exec_t:s0 Now use the restorecon command to apply this context mapping to the running system: restorecon -R -v /etc/rc.d/init.d/rsyncd Run the ls -lZ command to confirm the script has been labeled appropriately. Note that in the following output the script has been labeled as initrc_exec_t: ls -lZ /etc/rc.d/init.d/rsyncd-rwxr-xr-x. root root system_u:object_r:initrc_exec_t:s0 /etc/rc.d/init.d/rsyncd Launch rsyncd via the new script. Now that rsync has started from an init script that has been appropriately labeled, the process will start as rsync_t: # service rsyncd startStarting rsyncd: [ OK ]ps -eZ | grep rsyncunconfined_u:system_r:rsync_t:s0 9794 ? 00:00:00 rsync SELinux can now enforce its protection mechanisms over the rsync daemon as it is now runing in the rsync_t domain.
This example demonstrated how to get rsyncd running in the rsync_t domain. The next example shows how to get this daemon successfully running on a non-default port. TCP port 10000 is used in the next example. Running the rsync daemon on a non-default port Modify the /etc/rsyncd.conf file and add the port = 10000 line at the top of the file in the global configuration area (ie., before any file areas are defined). The new configuration file will look like: log file = /var/log/rsyncd.logpid file = /var/run/rsyncd.pidlock file = /var/run/rsync.lockport = 10000[files] path = /srv/files comment = file area read only = falsetimeout = 300 After launching rsync from the init script with this new setting, a denial similar to the following is logged by SELinux: Jul 22 10:46:59 localhost setroubleshoot: SELinux is preventing the rsync (rsync_t) from binding to port 10000. For complete SELinux messages. run sealert -l c371ab34-639e-45ae-9e42-18855b5c2de8 Run the semanage command to add TCP port 10000 to SELinux policy in rsync_port_t: # semanage port -a -t rsync_port_t -p tcp 10000 Now that TCP port 10000 has been added to SELinux policy for rsync_port_t, rsyncd will start and operate normally on this port: # service rsyncd startStarting rsyncd: [ OK ] # netstat -lnp | grep 10000tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN 9910/rsync
SELinux has had its policy modified and is now permitting rsyncd to operate on TCP port 10000. "What is Postfix? It is Wietse Venema's mailer that started life at IBM research as an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and secure. The outside has a definite Sendmail-ish flavor, but the inside is completely different." In Red Hat Enterprise Linux, the postfix package provides postfix. Run rpm -q postfix to see if the postfix package is installed. If it is not installed, run the following command as the root user to install it: yum install postfix 13.1. Postfix and SELinuxWhen Postfix is enabled, it runs confined by default. Confined processes run in their own domains, and are separated from other confined processes. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited. The following example demonstrates the Postfix and related processes running in their own domain. This example assumes the postfix package is installed and that the Postfix service has been started: Run getenforce to confirm SELinux is running in enforcing mode: $ getenforceEnforcing The getenforce command returns Enforcing when SELinux is running in enforcing mode. Run service postfix start as the root user to start postfix: service postfix startStarting postfix: [ OK ] Run ps -eZ | grep postfix to view the postfix processes: ps -eZ | grep postfixsystem_u:system_r:postfix_master_t:s0 1651 ? 00:00:00 mastersystem_u:system_r:postfix_pickup_t:s0 1662 ? 00:00:00 pickupsystem_u:system_r:postfix_qmgr_t:s0 1663 ? 00:00:00 qmgr For example, the SELinux context associated with the Postfix master process is unconfined_u:system_r:postfix_master_t:s0. The second last part of the context, postfix_master_t, is the type for this process. A type defines a domain for processes and a type for files. In this case, the master process is running in the postfix_master_t domain.
Type Enforcement is the main permission control used in SELinux targeted policy. All files and processes are labeled with a type: types define a domain for processes and a type for files. SELinux policy rules define how types access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it. The following types are used with Postfix. Different types all you to configure flexible access: postfix_etc_tThis type is used for configuration files for Postfix in the /etc/postfix/ directory. postfix_data_tThis type is used for Postfix data files in the /var/lib/postfix/ directory. postfix_var_run_tThis type is used for Postfix files stored in the /run/ directory. postfix_initrc_exec_tThis type is used for transition of Postfix executable files to the postfix_initrc_t domain. postfix_spool_tThis type is used for Postfix files stored in the /var/spool/ directory.
To see the full list of files and their types for Postfix, run the following command: $ grep postfix /etc/selinux/targeted/contexts/files/file_contexts SELinux is based on the least level of access required for a service to run. Services can be run in a variety of ways; therefore, you must tell SELinux how you are running services. The following Boolean allows you to tell SELinux how you are running Postfix: allow_postfix_local_write_mail_spoolHaving this Boolean enables Postfix to write to the local mail spool on the system. Postfix requires this Boolean to be enabled for normal operation when local spools are used.
13.4. Configuration Examples13.4.1. SpamAssassin and Postfix"Open Source mail filter, written in Perl, to identify spam using a wide range of heuristic tests on mail headers and body text. Free software." When using Red Hat Enterprise Linux, the spamassassin package provides SpamAssassin. Run rpm -q spamassassin to see if the spamassassin package is installed. If it is not installed, run the following command as the root user to install it: yum install spamassassin SpamAssassin operates in tandom with a mailer such as Postfix to provide spam-filtering capabilities. In order for SpamAssassin to effectively intercept, analyze and filter mail, it must listen on a network interface. The default port for SpamAssassin is TCP/783, however this can be changed. The following example provides a real-world demonstration of how SELinux complements SpamAssassin by only allowing it access to a certain port by default. This example will then demonstrate how to change the port and have SpamAssassin operate on a non-default port. Note that this is an example only and demonstrates how SELinux can affect a simple configuration of SpamAssassin. Comprehensive documentation of SpamAssassin is beyond the scope of this document. Refer to the official SpamAssassin documentation for further details. This example assumes the spamassassin is installed, that any firewall has been configured to allow access on the ports in use, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode: Running SpamAssassin on a non-default port Run the semanage command to show the port that SELinux allows spamd to listen on by default: # semanage port -l | grep spamdspamd_port_ttcp783 This output shows that TCP/783 is defined in spamd_port_t as the port for SpamAssassin to operate on. Edit the /etc/sysconfig/spamassassin configuration file and modify it so that it will start SpamAssassin on the example port TCP/10000: # Options to spamdSPAMDOPTIONS="-d -p 10000 -c m5 -H" This line now specifies that SpamAssassin will operate on port 10000. The rest of this example will show how to modify SELinux policy to allow this socket to be opened. Start SpamAssassin and an error message similar to the following will appear: # service spamassassin startStarting spamd: [2203] warn: server socket setup failed, retry 1: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied[2203] warn: server socket setup failed, retry 2: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied[2203] error: spamd: could not create INET socket on 127.0.0.1:10000: Permission deniedspamd: could not create INET socket on 127.0.0.1:10000: Permission denied [FAILED] This output means that SELinux has blocked access to this port. A denial similar to the following will be logged by SELinux: SELinux is preventing the spamd (spamd_t) from binding to port 10000. As the root user, run the semanage command to modify SELinux policy in order to allow SpamAssassin to operate on the example port (TCP/10000): semanage port -a -t spamd_port_t -p tcp 10000 Confirm that SpamAssassin will now start and is operating on TCP port 10000: # service spamassassin startStarting spamd:[ OK ]# netstat -lnp | grep 10000tcp00 127.0.0.1:100000.0.0.0:*LISTEN2224/spamd.pid At this point, spamd is properly operating on TCP port 10000 as it has been allowed access to that port by SELinux policy.
DHCPD is the daemon used in Red Hat Enterprise Linux to dynamically deliver and configure Layer 3 TCP/IP details for clients. The dhcp package provides the DHCP server, dhcpd. Run rpm -q dhcp to see if the dhcp package is installed. If it is not installed, run the following command as the root user to install it: yum install dhcp When DHCPD is enabled, it runs confined by default. Confined processes run in their own domains, and are separated from other confined processes. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited. The following example demonstrates the DHCPD and related processes running in their own domain. This example assumes the dhcp package is installed and that the DHCPD service has been started: Run getenforce to confirm SELinux is running in enforcing mode: $ getenforceEnforcing The getenforce command returns Enforcing when SELinux is running in enforcing mode. Run service dhcpd start as the root user to start DHCPD: service dhcpd startStarting dhcpd: [ OK ] Run ps -eZ | grep dhcpd to view the dhcpd processes: ps -eZ | grep dhcpdunconfined_u:system_r:dhcpd_t:s0 5483 ? 00:00:00 dhcpd The SELinux context associated with the dhcpd process is unconfined_u:system_r:dhcpd_t:s0.
The following types are used with dhcpd: dhcp_etc_tThis type is mainly used for files in /etc, including configuration files. dhcpd_var_run_tThis type is used for the PID file for dhcpd, in /var/run. dhcpd_exec_tThis type is used for transition of DHCP executable files to the dhcpd_t domain. dhcpd_initrc_exec_tThis type is used for transition of DHCP executable files to the dhcpd_initrc_t domain.
To see the full list of files and their types for dhcp, run the following command: $ grep dhcp /etc/selinux/targeted/contexts/files/file_contexts The following references are pointers to additional information that is relevant to SELinux but beyond the scope of this guide. Note that due to the rapid development of SELinux, some of this material may only apply to specific releases of Red Hat Enterprise Linux. Books - SELinux by Example
Mayer, MacMillan, and Caplan Prentice Hall, 2007 - SELinux: NSA's Open Source Security Enhanced Linux
Bill McCarty O'Reilly Media Inc., 2004
Tutorials and Help - Tutorials and talks from Russell Coker
- Dan Walsh's Journal
- Red Hat Knowledgebase
General Information - NSA SELinux main website
- NSA SELinux FAQ
Mailing Lists - NSA SELinux mailing list
- Fedora SELinux mailing list
Community - SELinux Project Wiki
- SELinux community page
- IRC
irc.freenode.net, #selinux
| Revision History |
|---|
| Revision 4-2 | Fri Feb 22 2013 | Tomáš Čapek | | Version for 6.4 GA release. |
| | Revision 3-0 | Wed Jun 20 2012 | Martin Prpič | | Red Hat Enterprise Linux 6.3 GA release of Managing Confined Services guide. |
| | Revision 2-0 | Tue Dec 6 2011 | Martin Prpič | | Red Hat Enterprise Linux 6.2 GA release of Managing Confined Services guide. |
| | Revision 1-0 | Thu May 19 2011 | Martin Prpič | | Red Hat Enterprise Linux 6.1 GA release of Managing Confined Services guide. |
| | Revision 0-0 | Tue Nov 9 2010 | Scott Radvan | |
|
| |
|
