\section{SELinux}
\begin{frame}
   {SELinux Overview}

   \begin{itemize}
      \item Developed by the NSA
      \item Additional method of protection
      \item Uses:
      \begin{itemize}
         \item Contexts
         \item Rules
         \item Policies
      \end{itemize}
      \item Actions not explicitly allowed are
      denied, by default

      \item Additional Online Resources:

      \textbf{SELinux User's and Administrator's Guide}:

      \url{https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/index}

   \end{itemize}
\end{frame}

\cprotect\note{


   \textbf{SELinux} was originally developed by the United
   States \textbf{NSA} (\textbf{N}ational
   \textbf{S}ecurity \textbf{A}dministration) and has been
   integral to \textbf{RHEL} for a very long time, which
   has brought it a large usage base.

   Operationally, \textbf{SELinux} is a set of security
   rules that are used to determine which processes can
   access which files, directories, ports, and other items
   on the system.

   It works with these three conceptual quantities:
   \begin{enumerate}
      \item
      \textbf{Contexts:} Are labels to files, processes and
      ports. Examples of contexts are \textbf{SELinux}
      user, role and type.
      \item
      \textbf{Rules:} Describe access control in terms of
      \textbf{contexts}, \textbf{processes},
      \textbf{files}, \textbf{ports}, \textbf{users}, etc.
      \item
      \textbf{Policies:} Are a set of \textbf{rules} that
      describes what system-wide access control decisions
      should be made by \textbf{SELinux}.
   \end{enumerate}

   An \textbf{SELinux} context is a label used by a rule
   to define how users, processes, files and ports
   interact with each other.  As the default policy is to
   deny any access, rules are used to describe allowed
   actions on the system.

}


\begin{frame}
   {SELinux Enforcement Modes I}

   \begin{multicols}{2}
      \begin{figure}[H]
         \includegraphics[width=2.8in]{IMAGES/SELinux_Mode_Enforcing}
         \caption{SELinux Enforcing Mode}
      \end{figure}

      \begin{figure}[H]
         \includegraphics[width=2.8in]{IMAGES/SELinux_Mode_Permissive}
         \caption{SELinux Permissive Mode}
      \end{figure}

   \end{multicols}

\end{frame}

\cprotect\note{

   These modes are selected (and explained) in a file
   (usually \filelink{/etc/selinux/config}) whose location
   varies by distribution (it is often either at
   \filelink{/etc/sysconfig/selinux} or linked from there).
   The file is well self-documented.

}

\begin{frame}
   {SELinux Enforcement Modes II}

   \begin{itemize}
      \item Three modes for \textbf{SELinux}
      \begin{itemize}
         \item Enforcing
         \item Permissive
         \item Disabled
      \end{itemize}
      \item Configured in \filelink{/etc/sysconfig/selinux}
      (\textbf{CentOS} and \textbf{openSUSE}) or
      \filelink{/etc/selinux/config} (\textbf{Ubuntu})
      \item Use \textbf{getenforce} and \textbf{setenforce}
      to see or set current mode
   \end{itemize}

\end{frame}

\cprotect\note{
   \begin{itemize}
      \item
      \textbf{Enforcing:} All \textbf{SELinux} code is
      operative and access is denied according to policy.
      All violations are audited and logged.
      \item
      \textbf{Permissive:} Enables \textbf{SELinux} code but
      only audits and warns about operations that would be
      denied in enforcing mode.
      \item
      \textbf{Disabled:} Completely disables \textbf{SELinux}
      kernel and application code leaving the system without
      any of its protections.
   \end{itemize}

   The \textbf{sestatus} utility can display the current mode
   and policy.

}

\begin{frame}
   {getenforce and setenforce}
   \begin{itemize}
      \item
      Examine or set the current mode:
      \begin{itemize}
         \item {getenforce}
         \begin{cmd}
$ getenforce
         \end{cmd}
         \begin{response}
Enforcing
         \end{response}
         \item \textbf{setenforce}
         \begin{cmd}
$ sudo setenforce Permissive
$ getenforce
         \end{cmd}
         \begin{response}
Permissive
         \end{response}
      \end{itemize}
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{setenforce} can be used to switch between
   enforcing and permissive mode on the fly while the
   system is in operation.  However, changing to in or out
   of the disabled mode can not be done this way.

   While \textbf{setenforce} allows you to switch between
   \textbf{Permissive} and \textbf{Enforcing} modes, it
   does not allow disabling \textbf{SELinux}
   completely. There are at least two different ways to
   disable \textbf{SELinux}:
   \begin{itemize}
      \item \textbf{Configuration file:} edit the
      \textbf{SELinux} configuration file (usually
      \filelink{/etc/selinux/config})  and set
      \texttt{SELINUX=disabled}.  This is the default method
      and should be used to permanently disable
      \textbf{SELinux}.
      \item \textbf{Kernel parameter:} Adding \texttt{selinux=0}
      to the Kernel parameter list when rebooting.
   \end{itemize}

   However it is important to note that disabling
   \textbf{SELinux} on systems in which \textbf{SELinux}
   will be re-enabled is not recommended. It is preferable
   to use \textbf{Permissive} mode instead of disabling
   \textbf{SELinux}, so as to avoid relabeling the entire
   filesystem which can be time consuming.
}

\begin{frame}
   {SELinux Policies}
   \begin{itemize}
      \item
      \textbf{targeted:}

      The \textbf{default} policy in which
      \textbf{SELinux} is more restrictive to targeted
      processes. User processes and \textbf{init}
      processes are not targeted, while network service
      processes are targeted.  \textbf{SELinux} enforces
      memory restrictions for \textbf{all} processes,
      which reduces the vulnerability to buffer overflow
      attacks.
      \item
      \textbf{minimum:}

      A modification of the targeted policy where only
      selected processes are protected.
      \item
      \textbf{MLS:}

      The \textbf{M}ulti-\textbf{L}evel \textbf{S}ecurity
      policy is much more restrictive; all processes are
      placed in fine-grained security domains with
      particular policies.
   \end{itemize}

\end{frame}

\cprotect\note{

The same configuration file that sets the mode, usually
\filelink{/etc/sysconfig/selinux}, also sets the
\textbf{SELinux} \textbf{policy}.

Multiple policies are allowed, but only one can be active
at a time.

Changing the policy may require a reboot of the system
and a time-consuming re-labeling of filesystem contents.

Each policy has files which must be installed under
\filelink{/etc/selinux/[SELINUXTYPE]}.
}

\begin{frame}
   {Context Utilities}

   \begin{itemize}

      \item
      Contexts and Context Utilities

      \begin{itemize}
         \item
         User
         \item
         Role
         \item
         Type
         \item
         Level
      \end{itemize}

      \item
      Look Up or Change a Context:

      \begin{itemize}
         \item
         Use -Z option to see context
         \begin{cmd}
$ ls -Z
$ ps auZ
         \end{cmd}
         \item
         Use \textbf{chcon} to change context
         \begin{cmd}
$ chcon -t etc_t somefile
$ chcon --reference somefile someotherfile
         \end{cmd}
      \end{itemize}
   \end{itemize}
\end{frame}

\cprotect\note{

   As mentioned earlier, contexts are labels applied to
   files, directories, ports, and processes. Those labels are
   used to describe access rules. There are four
   \textbf{SELinux} contexts, \textbf{User}, \textbf{Role}, \textbf{Type},
   and \textbf{Level}.

   We will focus on \textbf{type}, the most commonly utilized
   context. The label naming convention determines that type
   context labels should end with \verb?_t? as in \verb?kernel_t?.

   \begin{cmd}
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. dog dog unconfined_u:object_r:user_home_t:s0 somefile
   \end{response}
   \begin{cmd}
$ chcon -t etc_t somefile
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0   somefile
   \end{response}
   \begin{cmd}
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0   somefile
-rw-rw-r--. dog dog unconfined_u:object_r:user_home_t:s0 somefile1
   \end{response}
   \begin{cmd}
$ chcon --reference somefile somefile1
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0   somefile
-rw-rw-r--. dog dog unconfined_u:object_r:etc_t:s0   somefile1
   \end{response}

}

\begin{frame}
   {SELinux and Standard Commands}

   \begin{itemize}
      \item
      Many basic utilities (\textbf{ls}, \textbf{ps},
      \textbf{cp}, etc., extended to work with
      \textbf{SELinux}
      \item
      Usually add \verb?Z? option as in:
      \begin{cmd}
$ ls -Z ...
$ ps axZ
      \end{cmd}
      \item
      With \textbf{SELinux} disabled, extended options do nothing
   \end{itemize}
\end{frame}

\cprotect\note{

   Many standard command line commands, such as \textbf{ls}
   and \textbf{ps}, were extended to support
   \textbf{SELinux}, and corresponding sections were added to
   their \textbf{man} pages explaining the details. Often the
   parameter \verb?Z? is passed to standard command line
   tools as in:

   \begin{cmd}
$ ps axZ
   \end{cmd}
   \begin{response}
LABEL PID TTY STAT TIME COMMAND
system_u:system_r:init_t:s0 1 ? Ss 0:04 /usr/lib/systemd/systemd --switched-root ...
system_u:system_r:kernel_t:s0 2 ? S 0:00 [kthreadd]
...
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 2305 ? D 0:00 sshd: jimih@pts/0
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 2306 pts/0 Ss 0:00 -bash
...
system_u:system_r:httpd_t:s0 7490 ? Ss 0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0 7491 ? S 0:00 /usr/sbin/httpd -DFOREGROUND
...
   \end{response}
   \begin{cmd}
$ ls -Z /home/ /tmp/
   \end{cmd}
   \begin{response}
/home/:
drwx------. jimih jimih unconfined_u:object_r:user_home_dir_t:s0 jimih
/tmp/:
-rwx------. root root system_u:object_r:initrc_tmp_t:s0 ks-script-c4ENhg
drwx------. root root system_u:object_r:tmp_t:s0 systemd-private-0ofSvO
-rw-------. root root system_u:object_r:initrc_tmp_t:s0 dnf.log
   \end{response}

   Other tools that were extended to support \textbf{SELinux}
   include \textbf{cp}, \textbf{mv}, and \textbf{mkdir}.

   Note that if you have disabled \textbf{SELinux}, no useful
   information is displayed in the related fields from these
   utilities.

}

\begin{frame}
   {Context Inheritance}

   \begin{itemize}
      \item
      New files inherit context from parent directory
      \item
      When moving files, source directory context
      preserved
      \item
      Can cause problems if context is not modified
   \end{itemize}
\end{frame}

\cprotect\note{

   Newly created files inherit the context from their parent
   directory, but when moving or copying files, it is the
   context of the source directory which may be preserved,
   which can cause problems.

   Continuing the previous example, we see the context of
   \filelink{tmpfile} was not changed by moving the file from
   \filelink{/tmp} to \filelink{/home/jimih}:
   \begin{cmd}
$ cd /tmp/
$ touch tmpfile
$ ls -Z tmpfile
   \end{cmd}
   \begin{response}
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_tmp_t:s0 tmpfile
   \end{response}
   \begin{cmd}
$ cd
$ touch homefile
$ ls -Z homefile
   \end{cmd}
   \begin{response}
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_home_t:s0 homefile
   \end{response}
   \begin{cmd}
$ mv /tmp/tmpfile .
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_home_t:s0 homefile
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_tmp_t:s0 tmpfile
   \end{response}

   The classical example in which moving files creates an
   \textbf{SELinux} issue is moving files to the
   \verb?DocumentRoot?  directory of the \textbf{httpd}
   server. On \textbf{SELinux}-enabled systems, the web server
   can only access files with the correct context
   labels. Creating a file in \filelink{/tmp}, and then moving
   it to the \verb?DocumentRoot? directory, will make the file
   inaccessible to the \textbf{httpd} server until the
   \textbf{SELinux} context of the file is adjusted.

}

\begin{frame}
   {restorecon}

   \begin{itemize}

      \item
      Reset file context in accord with parent directory:

      \begin{cmd}
$ restorecon -Rv /home/jimih
      \end{cmd}

   \end{itemize}
\end{frame}

\cprotect\note{

   \textbf{restorecon} resets file contexts, based on parent
   directory settings.

   In the following example, \textbf{restorecon} resets the
   default label recursively for all files at the home
   directory:

   \begin{cmd}
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_home_t:s0 homefile
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_tmp_t:s0 tmpfile
   \end{response}
   \begin{cmd}
$ restorecon -Rv /home/jimih
   \end{cmd}
   \begin{response}
restorecon reset /home/jimih/tmpfile context \
           unconfined_u:object_r:user_tmp_t:s0->unconfined_u:object_r:user_home_t:s0 
   \end{response}
   \begin{cmd}
$ ls -Z
   \end{cmd}
   \begin{response}
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_home_t:s0 homefile
-rw-rw-r--. jimih jimih unconfined_u:object_r:user_home_t:s0 tmpfile
   \end{response}

   Note that the context for \filelink{tmpfile} has been
   reset to the default context for files created at the home
   directory. The type was changed from \verb?user_tmp_t? to
   \verb?user_home_t?.

}

\begin{frame}
   {semanage}

   \begin{itemize}
      \item
      Configure default context for a new directory
      \item
      Changes only default settings, not existing ones
      \item
      \textbf{restorecon} must be called afterwards to change
      existing contexts
   \end{itemize}
\end{frame}

\cprotect\note{

   Another issue is how to configure the default context for
   a newly created directory. \textbf{semanage fcontext} (provided by
   the \textbf{policycoreutils-python} package) can change and display
   the default context of files and directories. Note
   that \textbf{semanage fcontext} only changes the default settings;
   it does not apply them to existing objects. This requires
   calling \textbf{restorecon} afterwards. For example:
   \begin{cmd}
[root@rhel7 /]# mkdir /virtualHosts
[root@rhel7 /]# ls -Z
   \end{cmd}
   \begin{response}
...
drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 virtualHosts
   \end{response}
   \begin{cmd}
[root@rhel7 /]# semanage fcontext -a -t httpd_sys_content_t /virtualHosts
[root@rhel7 /]# ls -Z
   \end{cmd}
   \begin{response}
...
drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 virtualHosts
   \end{response}
   \begin{cmd}
[root@rhel7 /]# restorecon -RFv /virtualHosts
   \end{cmd}
   \begin{response}
restorecon reset /virtualHosts context \
           unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
   \end{response}
   \begin{cmd}
[root@rhel7 /]# ls -Z
   \end{cmd}
   \begin{response}
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 virtualHosts
   \end{response}

   The context change from \verb?default_t? to \verb?httpd_sys_content_t? is
   thus only applied after the call to \textbf{restorecon}.


}




\begin{frame}
   {Using SELinux Booleans}

   \begin{itemize}
      \item Change the behavior of \textbf{SELinux} policy
      \item Can be enabled or disabled
      \begin{itemize}
         \item \textbf{getsebool}: to see booleans
         \item \textbf{setsebool}: to set booleans
         \item \textbf{semanage boolean -l}: to see
         persistent boolean settings
      \end{itemize}
   \end{itemize}

\end{frame}

\cprotect\note{
   \begin{cmd}
$ setsebool allow_ftpd_anon_write on
$ getsebool allow_ftpd_anon_write
  allow_ftpd_anon_write -> on
$ semanage boolean -l | grep allow_ftpd_anon_write
$ allow_ftpd_anon_write -> off
   \end{cmd}
   Note not persistent.
   \begin{cmd}
$ setsebool -P allow_ftpd_anon_write on
$ semanage boolean -l | grep allow_ftpd_anon_write
  allow_ftpd_anon_write          -> on
   \end{cmd}
   Now persistent.

   \begin{figure}[H]
      \includegraphics[width=3.75in]{IMAGES/semanage}
      \caption{semanage}
   \end{figure}
   \vspace{-20pt}

}

\begin{frame}
   {Monitoring SELinux Access}

   \begin{itemize}
      \item Use \textbf{setroubleshoot-server} to track
      \textbf{SELinux} errors
      \begin{itemize}
         \item After install, restart \textbf{auditd}
         service
      \end{itemize}
      \item Stores raw messages in
      \filelink{/var/log/audit/audit.log}
      \item Moves messages to \filelink{/var/log/messages}
      \item Use \textbf{sealert} to see detailed message
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{SELinux} comes with a set of tools that collect
   issues at run time, log these issues and propose solutions
   to prevent same issues from happening again. These
   utilities are provided by the
   \textbf{setroubleshoot-server} package. Here is an example
   of their use:
   \vspace{10pt}
   \begin{responsevar}{\footnotesize}
[root@rhel7 ~]# echo 'File created at /root' > rootfile
[root@rhel7 ~]# mv rootfile /var/www/html/
[root@rhel7 ~]# wget -O - localhost/rootfile
--2014-11-21 13:42:04--  http://localhost/rootfile
Resolving localhost (localhost)... ::1, 127.0.0.1
Connecting to localhost (localhost)|::1|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
2014-11-21 13:42:04 ERROR 403: Forbidden.

[root@rhel7 ~]# tail /var/log/messages
Nov 21 13:42:04 rhel7 setroubleshoot: Plugin Exception restorecon
Nov 21 13:42:04 rhel7 setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr access on the file .
For complete SELinux messages. run sealert -l d51d34f9-91d5-4219-ad1e-5531e61a2dc3
Nov 21 13:42:04 rhel7 python: SELinux is preventing /usr/sbin/httpd from getattr access on the file .
.....
Do allow this access for now by executing:
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context unconfined_u:object_r:admin_home_t:s0
Target Objects [ file ]
Source httpd
Source Path /usr/sbin/httpd
......
   \end{responsevar}

}

