How to live with SELinux
•Als ODP, PDF herunterladen•
11 gefällt mir•2,335 views
presentation I gave for the people at whitespace, Ghent..
![You can find me here ,[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie How to live with SELinux
Ähnlich wie How to live with SELinux (20)
Mehr von Bert Desmet
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
How to live with SELinux
- 1. How to live with SELinux Bert Desmet – Fedora Ambassador
- 7. Irc: biertie @ Freenode / Quakenet
- 9. Google me for more And if you have any questions, feel free to contact me..
- 12. Designer of the T shirt
- 14. How to live with SELinux
- 18. Backing up and copying
- 21. Build by NSA
- 23. RBAC: user privilege controls
- 26. Reduces vulnerability to attacks
- 29. No firewall
- 30. ....
- 40. setsebool -P $boolean {on|off}
- 44. object_r: role aspect for the context
- 46. S0: level of security
- 48. semange fcontext -dv ${file|dir}name
- 51. fixfiles -R $packagename restore
- 58. It does when you move on the same partition
- 59. Use cp command
- 64. audit2allow -am $name > $name.te
- 65. -D flag
- 69. It's secure
- 71. Questions? E-mail: [email_address] Twitter: @biertie identi.ca: @bdesmet Web: http://bdesmet.be
Hinweis der Redaktion
- MLS: Multi-Level Security RBAC: Role-based access control TE: Type Enforcement MAC: mandatory acces control <-> DAC: Discretionary acces control Adds extra control over processes and users (what files can x or y change)
- Good access control, unlike DAC from normal linux system. SELinux user, role, type, level while linux user only have a group and user id Reduces vulnerability to attacks due to access control. Intruders can only access the files the software (like httpd) really need Confined servers: selinux has the abitilty to confine services and deamons so that they are more predictable and are only allowed acces that is required for their normal operation
- Independent from normal linux ownerships blah blah
- Var/log/messages are better readable, but rsyslogd is not always running. Chkconfig –levels 2345 rsyslogd on
- Booleans Changed at runtime No policy writing
- Predefined policies The semanage boolean command doesn't work yet on RH/Centos 5.x -P flag makes it persistent over reboots
- Identity authorized for specific set of roles, and mls range. Semange login -l Each linux user is mapped to a sel user Role is part of the RBAC model. Type is an attribute of type enforcement. Defines domain for processes, and type for files. Level of security is attribute for MLS. For process, unconfined_t : is not checked (in targeted)
- Chcon -t httpd_sys_content_t /web Use full path of file/dir Restore only works with chcon semange fcontext adds rule to file.contexts.local, chcon doesn't After a fcontext -d run restorecon again.
- Fixfiles relabel can make system unstable Fixfiles -R relies on rpm database
- Standard type: nfs_t Context changes to the files on the mount won't work. Chcon results in “operation not supported” /dev/sda2: assumes there are no rules that define context for /foo/ Files will keep context when changed Persistent: fstab
- If you copy a file over a file, original context is preserved
- matchpathcon - get the default security context for the specified path from the file contexts configuration. Semodule -D : disables dontaudit rules -B : rebuilds policy Run semodule -B again after debugging
- cat $name.te
- Semodule: import the module