Selinux can be confusing, but it's ordinary and default
configuration is actually pretty simple. We'll examine it on
Fedora Core 5.
By default, FC5 installs Selinux in "targeted" mode. You
can see this in /etc/selinux/config:
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - SELinux is fully disabled.
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
# SETLOCALDEFS= Check local definition changes
As the comments imply, only certain network daemons are affected
by Selinux in this configuration. You can see which daemons
are included and modify the security policies for them in
a graphical tool ( System->Administration->Security Level and Firewall).
The idea here is that Selinux can prevent these daemons from misbehaving
even if they escape from the ordinary permissions and controls that
surround them. We'll use the httpd daemon to demonstrate this.
First, we need to turn httpd on if it isn't already:
# chkconfig httpd on
# /etc/init.d/httpd start
Next, I want to create a data directory:
# cd /var/www
# mkdir data
# chmod o+w data
Then we'll create a silly little cgi script to write something
in that directory:
# this is /var/www/cgi-bin/se.pl
use CGI qw(:standard);
print O "foo" or print "<br />Cannot $!";
Be sure to "chmod 755" that script. If you then visit
"http://localhost/cgi-bin/se.pl", "hello" will apear on the browser
screen and the file "foo" will be created in the data directory. You'd
expect that, of course. But there's more going on underneath.
To see what that is, use the new "-Z" flag with "ls":
[root@localhost www]# ls -Z
drwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t cgi-bin
drwxr-xrwx root root user_u:object_r:httpd_sys_content_t data
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t error
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t html
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t icons
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t manual
drwxr-xr-x webalize root system_u:object_r:httpd_sys_content_t usage
"-Z" shows Selinux context for files. We don't need to entirely understand
what this all means yet; just accept that -Z shows the details. You can also
use -Z with ps:
[root@localhost www]# ps auxwZ | grep httpd
user_u:system_r:httpd_t root 27529 0.0 3.7 22616 9732 ? Ss 19:59 0:00 /usr/sbin/httpd
This shows that httpd is running in a specific selinux context (user_u:system_r:httpd_t). Again, we don't need to understand the specifics of what that
means at this point.
If we look at the file "foo" that our script created, we see that
it also has a context:
-rw-r--r-- apache apache user_u:object_r:httpd_sys_content_t foo
By default, files inherit selinux context from their parent directories.
That's why "foo" has "user_u:object_r:httpd_sys_content_t". However,
we can change it:
# cd /var/www
# chcon system_u:object_r:httpd_sys_script_exec_t data
All I'm doing there is making "data" match the "cgi-bin" directory's context.Selinux wouldn't allow httpd to write into its cgi-bin directory, so
I just used that as a pattern.
If we reload the "http://localhost/cgi-bin/se.pl", it still works.
The file "foo" already exists, and still has "user_u:object_r:httpd_sys_content_t". However, if we remove foo, the se.pl will now fail and complain
"Cannot Bad file descriptor". Nothing else has changed: the directory
permissions still allow Apache to create the file, but Selinux does
not because we gave the directory a security context that httpd is not
allowed to write to.
Remember, these contexts only affect daemons targetted by Selinux.
Nothing else is constrained: root can still do anything it likes.
However, if Selinux were NOT running just targeted daemons, even
root could not bypass its security. Setting up system like
that can be a little tricky (Selinux has a well deserved reputation
for complexity), but if you'd like to read more about it, see these
Got something to add? Send me email.
Increase ad revenue 50-250% with Ezoic
More Articles by Anthony Lawrence
Find me on Google+
© 2011-05-01 Anthony Lawrence