SELinux - Versionshistorik

Js146669: /* Commands with SELinux support */

2021-05-26T16:38:57Z

‎Commands with SELinux support

Js146669 den 26 maj 2021 kl. 15.06

2021-05-26T15:06:55Z

Js146669 den 26 maj 2021 kl. 14.17

2021-05-26T14:17:03Z

Js146669 den 26 maj 2021 kl. 14.10

2021-05-26T14:10:55Z

Js146669 den 26 maj 2021 kl. 14.10

2021-05-26T14:10:24Z

← Äldre version		Versionen från 26 maj 2021 kl. 16.38
Rad 124:		Rad 124:
	$ rsync -a X \| copy between hosts retaining security context		$ rsync -a X \| copy between hosts retaining security context
	'''N.B!''' The preferred alternative is to copy/mv files and then perform $ restorecon to reapply security context.		'''N.B!''' The preferred alternative is to copy/mv files and then perform $ restorecon to reapply security context.
		+
		+	== URLS ==
		+	[https://wiki.centos.org/HowTos/SELinux#Customizing_SELinux_Policies CentOS Creating Custom SELinux Policy Modules with audit2allow]

@@ Rad 1: / Rad 1: @@
-'''Types of access control'''
+== Types of access control ==
   '''Discretionary Access Control''' = FACL, File perms, SUID/SGID, SU/Sudo
@@ Rad 14: / Rad 14: @@
   '''N.B!''' Permissive mode is good for troubleshooting SELINUX policy issues
-'''Enforcement Policies'''
+== Enforcement Policies ==
 *'''Type enforcement''' | Default policy, what types can do to other types.
@@ Rad 63: / Rad 63: @@
   '''N.B!''' It’s best to change the policy and then use $ restorecon to set the context, rather than use $ chcon. Only use chcon to troubleshoot.
-'''SELINUX Boleans'''
+== SELINUX Boleans ==
 To Display the booleans use the following cmds:-
@@ Rad 77: / Rad 77: @@
   $ semanage boolean -l | egrep ‘SELinux|mozilla_plugin_use_gps’
-'''SELinux logging'''
+== SELinux logging ==
 If auditd is running the logs are stored in:-
@@ Rad 100: / Rad 100: @@
   tcontext = object context
-'''Possible solutions to SELinux errors'''
+== Possible solutions to SELinux errors ==
 Change a Boolean to allow the action
@@ Rad 111: / Rad 111: @@
   $ audit2allow
-'''Troubleshooting actions/steps'''
+== Troubleshooting actions/steps ==
 *Put SELinux in permissive mode
 *Run the application that was denied
@@ Rad 118: / Rad 118: @@
 *Follow instructions in SELinux alert browser
-'''Commands with SELinux support'''
+== Commands with SELinux support ==
   $ cp -a          | preserves SELinux contexts
   $ mv             | preserves by default is keeps file metadata unchanged

@@ Rad 3: / Rad 3: @@
   '''Mandatory Access Control''' = OS controls access
 *'''Subject'''| user or process that accesses an object.
 *'''Object''' | a resource e.g. file, dir, device or pipe
@@ Rad 49: / Rad 50: @@
   $ chcon -t etc_t <filename>
   $ restorecon <filename>  | Resets the context to the value stored in the context database.
-                           | So you don’t have to guess when restoring the file to it’s original setting.
+                           | So you don’t have to guess when restoring the file to its original setting.
 Restore all files back to original security context, create a file in root and reboot:-
   $ touch /.autorelabel
-If you don’t want autorelabel och restorecon to work on a file exec to edit the security context database:-
+If you don’t want autorelabel och restorecon to work on a file execute the following to edit the security context database:-
   $ semanage fcontext -a -t <type> <filename>
@@ Rad 70: / Rad 71: @@
   $ semanage boolean -l      | This also displays a short description of the boolean
 To set a boolean:-
-  $ setsebool mozilla_plugin_use_gps on   |Only temp until reboot
+  $ setsebool mozilla_plugin_use_gps on   |Only temporary until a reboot
 Add to policy to make changes persistent.
   $ setsebool -P mozilla_plugin_use_gps on  | Persistent i.e survives a reboot

@@ Rad 39: / Rad 39: @@
 The “unconfined_t” column is the important one to check.
-To check this execute the following steps:-
+To check this, execute the following steps:-
   $ ls -lZ /usr/bin/passwd
   $ ls -lZ /etc/shadow

@@ Rad 35: / Rad 35: @@
 Display file security context
   $ ls -lZ
-SELinux supports domain transitioning which means subjects can move from one type to another,
+SELinux supports domain transitioning which means subjects can move from one type to another, if allowed in the security policy.
-−
 if allowed in the security policy.
 The “unconfined_t” column is the important one to check.