^_^ semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ staff_u s0-s0:c0.c1023 *
plautrba staff_u s0-s0:c0.c1023 *
root root s0-s0:c0.c1023 *
^_^ semanage user -l | grep staff_u
staff_u user s0 s0-s0:c0.c1023 secadm_r staff_r sysadm_r system_r unconfined_r
^_^ semanage boolean -l -C
SELinux boolean State Default Description
selinuxuser_tcp_server (on , on) Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.
staff_use_svirt (on , on) allow staff user to create and transition to svirt domains.
xserver_execmem (on , on) Allows XServer to execute writable memory
Motivation When a bug comes to Fedora or Red Hat Enterprise Linux we need to check if it’s a downstream bug, or if the bug is still present or fixed upstream. For such cases it’s useful to have a simple mechanism to replace the downstream code from packages …
Motivation When a bug comes to Fedora or Red Hat Enterprise Linux we need to check if it’s a downstream bug, or if the bug is still present or fixed upstream. For such cases it’s useful to have a simple mechanism to replace the downstream code from packages with a code build from the latest upstream sources. Manual process is a little bit complicated You need to do several steps in...
Since SELinux userspace 2.4, there are no versions in semodule -l output. One of the reasons is that CIL, which is used as intermediate language in SELinux modules store for cached modules, doesn’t support a module name nor a module version. Another reason is that the version wasn …
Since SELinux userspace 2.4, there are no versions in semodule -l output. One of the reasons is that CIL, which is used as intermediate language in SELinux modules store for cached modules, doesn’t support a module name nor a module version. Another reason is that the version wasn’t really used by SELinux tools. semodule -i did the same thing as semodule -u and both didn’t check a module version. So you could simply...
Hi. This is a draft of a future packaging guidelines changes related to packaging SELinux modules. The text will be based on the original draft from 2012 - https://fedoraproject.org/wiki/PackagingDrafts/SELinux, but it will contain several process improvements. Use macros Some operations can done using macro defined in …
Hi. This is a draft of a future packaging guidelines changes related to packaging SELinux modules. The text will be based on the original draft from 2012 - https://fedoraproject.org/wiki/PackagingDrafts/SELinux, but it will contain several process improvements. Use macros Some operations can done using macro defined in selinux-policy. It allows to ensure that SELinux modules and policy packaging is consistent across variety systems. Since selinux-policy-x.y.z.fcNN, there are several macros available which simplify spec files...
libselinux provides an API for SELinux applications to get and set process and file security contexts and to obtain security policy decisions Examples Two simple one line examples which get basic information about SELinux status. $ python3 -c 'import selinux; print(selinux.is_selinux_enabled())' 1 $ python3 -c 'import selinux; print(["permissive", "enforcing …
libselinux provides an API for SELinux applications to get and set process and file security contexts and to obtain security policy decisions Examples Two simple one line examples which get basic information about SELinux status. $ python3 -c 'import selinux; print(selinux.is_selinux_enabled())' 1 $ python3 -c 'import selinux; print(["permissive", "enforcing", "disabled"][selinux.security_getenforce()])' enforcing Another example with a check if SELinux was updated. >>> import selinux >>> selinux.selinux_status_open(0) 0 >>> selinux.selinux_status_updated() 0 >>> selinux.selinux_status_policyload() 9 >>> selinux.selinux_status_updated() 0 >>> import os >>> os.system("sudo semodule...
DBUS API There are 3 new method available in org.fedoraproject.SetroubleshootdIface DBUS interface. All of them were added on request from Cockpit project which uses them for its SELinux troubleshooting feature - http://cockpit-project.org/guide/latest/feature-selinux.html set_filter() Sets a filter on an alert. The alert can be …
DBUS API There are 3 new method available in org.fedoraproject.SetroubleshootdIface DBUS interface. All of them were added on request from Cockpit project which uses them for its SELinux troubleshooting feature - http://cockpit-project.org/guide/latest/feature-selinux.html set_filter() Sets a filter on an alert. The alert can be always filtered, never filtered or after_first filtered. get_all_alerts_ignored() Returns an array of local_id's, summary's, and report_count's of all alerts which a user set to be ignored. delete_alert() Deletes an alert from...
When a record in audit log contains a white space, it's encoded to HEX string, e.g.: type=PROCTITLE msg=audit(1449583261.740:1899): proctitle=2F7573722F62696E2F7065726C002F7573722F73686172652F617773746174732F777777726F6F742F6367692D62696E2F617773746174732E706C002D757064617465002D636F6E6669673D68756C6B2E6C6F63616C002D636F6E6669676469723D2F6574632F61777374617473 This string can be simply decoded using a python script: $ python -c 'import binascii; print binascii.a2b_hex("2F7573722F62696E2F7065726C002F7573722F73686172652F617773746174732F777777726F6F742F6367692D62696E2F617773746174732E706C002D757064617465002D636F6E6669673D68756C6B2E6C6F63616C002D636F6E6669676469723D2F6574632F61777374617473")' /usr/bin/perl/usr/share/awstats/wwwroot/cgi-bin/awstats.pl-update-config=hulk.local-configdir=/etc/Read More
Sometimes, you want to know when an SELinux rule is used, e.g. when/if sshd opens an authorized_keys file in a user home. You can use auditallow rule for that and check audit log: # cat > auditsshd.cil (auditallow sshd_t ssh_home_t (file (open))) # semodule -i auditsshd.cil Now when I log in using ssh I can see this records audit.log: time->Tue Dec 8 14:36:42 2015 type=PROCTITLE msg=audit(1449581802.796:1871): proctitle=737368643A206261636872616473757369205B707269765D type=PATH msg=audit(1449581802.796:1871): item=0 name="/home/bachradsusi/.ssh/authorized_keys" inode=3280290 dev=fd:03 mode=0100600 ouid=13567 ogid=13567 rdev=00:00 obj=unconfined_u:object_r:ssh_home_t:s0 nametype=NORMAL type=CWD...
Sometimes, you hit a policy issue, make non-standard configuration changes or you just need a daemon to work regardless of SELinux restriction. In these cases you might want to switch a domain to be permissive: # semanage permissive -a This simple command creates and loads a module permissive_ with one rule: # bzcat /var/lib/selinux/targeted/active/modules/400/permissive_openvpn_t/cil (typepermissive openvpn_t) From this point, SELinux is not enforced on openvpn_t while AVCs are still logged...
introduction The new SELinux modules storage in /var/lib/selinux/ allows to use priority on SELinux modules. # ls /var/lib/selinux/targeted/active/modules 100 400 disabled The default priority and priority used in selinux-policy-*** packages is 100. # ls /var/lib/selinux/targeted/active/modules/100 | wc -l 396 It means that a user can overwrite an existing module with a module she modified. The highest priority wins. # semodule --list-modules=full | grep sandbox 400 sandbox pp 100 sandbox...