In his previous talk, Paul talked about getting your system to work with SELinux. This involved setting the security on your files and directories so that they worked with SELinux. However, many people have customised their Linux installs and want SELinux to do what they say, not the other way around. Sysadmins in particular are not 'run of the mill' users, and they have different requirements to what typically comes out of the box. Situations such as serving web pages from NFS shares or non-standard directories, or installing applications in custom locations, need specialised configuration of SELinux in order to make it work with your needs. This talk will deal with those situations. Fortunately for Sysadmins, much of the work in developing SELinux policies for Linux has focussed on their requirements. Paul will show you a few of the things behind the scenes that make your job as a Sysadmin much easier and safer with SELinux.

1. SELinux for Sysadmins

2. SELinux for Sysadmins Beyond 'restorecon'

5. Through real world examples

8. [client]# cat /etc/fstab ... server:/home /home nfs soft 1 2 ...

10. [client]# cat /etc/fstab ... server:/home /home nfs soft 1 2 ...

11. [client]# mount /home Permission denied

13. Is this a SELinux problem?

30. setsebool -P samba_enable_home_dirs on

41. Inherited like permissions

45. Use the right file context

46. man {ftpd,named,rsync,httpd,nfs,samba, kerberos,nis,ypbind}_selinux is your friend!

51. getsebool -a | grep ftp allow_ftpd_anon_write --> off allow_ftpd_full_access --> off allow_ftpd_use_cifs --> off allow_ftpd_use_nfs --> off ftp_home_dir --> off ftpd_connect_db --> off httpd_enable_ftp_server --> off tftp_anon_write --> off

53. allow_ftpd_use_cifs is written to allow (vs)ftpd to share a directory that is mounted from a CIFS server!

55. allow_ftpd_use_cifs is written to allow (vs)ftpd to share a directory that is mounted from a CIFS server!

56. What to do?

59. # selinuxenabled && echo yes

60. #

62. # run service, exercise functionality

64. # run service, exercise functionality

65. # setenforce on

67. # run service, exercise functionality

68. # setenforce on

69. # grep vsftpd /var/log/audit/audit.log | audit2allow -M -m vsftpd

71. # run service, exercise functionality

72. # setenforce on

73. # grep vsftpd /var/log/audit/audit.log | audit2allow -M -m vsftpd

74. # ls vsftpd.* vsftpd.pp vsftpd.te

77. # run service, exercise functionality

78. # setenforce on

79. # grep vsftpd /var/log/audit/audit.log | audit2allow -M -m vsftpd

80. # semodule -i vsftpd.pp

82. Use the right file context

83. man {ftpd,named,rsync,httpd,nfs,samba, kerberos,nis,ypbind}_selinux is your friend!

84. Create policy where necessary

86. Use the right file context

87. man {ftpd,named,rsync,httpd,nfs,samba, kerberos,nis,ypbind}_selinux is your friend!

88. Create policy where necessary

89. Policy must be conservative

91. Use the right file context

92. man {ftpd,named,rsync,httpd,nfs,samba, kerberos,nis,ypbind}_selinux is your friend!

93. Create policy where necessary

94. Policy must be conservative

96. Use the right file context

97. man {ftpd,named,rsync,httpd,nfs,samba, kerberos,nis,ypbind}_selinux is your friend!

98. Create policy where necessary

99. Policy must be conservative

100. system-config-selinux

101. Questions?