Using SELinux
Using SELinux Red Hat Enterprise Linux 9 Prevent users and processes from performing unauthorized interactions with files and devices by using Security-Enhanced Linux (SELinux) Red Hat Customer Content Services
getenforce Enforcing setenforce 0 getenforce Permissive setenforce 1 getenforce Enforcing semanage permissive -a httpd_t USD sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 31 vi /etc/selinux/config This file controls the state of SELinux on the system. SELINUX= can take one of these three values: enforcing - SELinux security policy is enforced. permissive - SELinux prints warnings instead of enforcing. disabled - No SELinux policy is loaded. SELINUX= permissive SELINUXTYPE= can take one of these two values: targeted - Targeted processes are protected, mls - Multi Level Security protection. SELINUXTYPE=targeted reboot getenforce Permissive vi /etc/selinux/config This file controls the state of SELinux on the system. SELINUX= can take one of these three values: enforcing - SELinux security policy is enforced. permissive - SELinux prints warnings instead of enforcing. disabled - No SELinux policy is loaded. SELINUX= enforcing SELINUXTYPE= can take one of these two values: targeted - Targeted processes are protected, mls - Multi Level Security protection. SELINUXTYPE=targeted reboot getenforce Enforcing ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts today grep "SELinux is preventing" /var/log/messages dmesg | grep -i -e type=1300 -e type=1400 reboot fixfiles -F onboot getenforce Enforcing rpm -q grubby grubby- <version> sudo grubby --update-kernel ALL --args selinux=0 reboot getenforce Disabled touch /.autorelabel reboot dnf install kernel-doc less /usr/share/doc/kernel-doc- 4.18.0 /Documentation/admin-guide/kernel-parameters.txt user_u:user_r:user_t # semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * default unconfined_u s0-s0:c0.c1023 * seinfo -u Users: 8 guest_u root staff_u sysadm_u system_u unconfined_u user_u xguest_u USD seinfo -r Roles: 14 auditadm_r dbadm_r guest_r logadm_r nx_server_r object_r secadm_r staff_r sysadm_r system_r unconfined_r user_r webadm_r xguest_r semanage boolean -l SELinux boolean State Default Description ... xguest_connect_network (on , on) Allow xguest users to configure Network Manager and connect to apache ports xguest_exec_content (on , on) Allow xguest to exec content ... SELinux boolean State Default Description guest_exec_content (on , on) Allow guest to exec content SELinux boolean State Default Description xguest_connect_network (on , on) Allow xguest users to configure Network Manager and connect to apache ports xguest_exec_content (on , on) Allow xguest to exec content xguest_mount_media (on , on) Allow xguest users to mount removable media xguest_use_bluetooth (on , on) Allow xguest to use blue tooth devices SELinux boolean State Default Description unprivuser_use_svirt (off , off) Allow unprivileged user to create and transition to svirt domains. SELinux boolean State Default Description staff_exec_content (on , on) Allow staff to exec content staff_use_svirt (on , on) allow staff user to create and transition to svirt domains. SELinux boolean State Default Description auditadm_exec_content (on , on) Allow auditadm to exec content SELinux boolean State Default Description dbadm_exec_content (on , on) Allow dbadm to exec content dbadm_manage_user_files (off , off) Determine whether dbadm can manage generic user files. dbadm_read_user_files (off , off) Determine whether dbadm can read generic user files. SELinux boolean State Default Description logadm_exec_content (on , on) Allow logadm to exec content SELinux boolean State Default Description webadm_manage_user_files (off , off) Determine whether webadm can manage generic user files. webadm_read_user_files (off , off) Determine whether webadm can read generic user files. SELinux boolean State Default Description secadm_exec_content (on , on) Allow secadm to exec content setsebool -P ssh_sysadm_login on SELinux boolean State Default Description ssh_sysadm_login (on , on) Allow ssh logins as sysadm_r:sysadm_t sysadm_exec_content (on , on) Allow sysadm to exec content xdm_sysadm_login (on , on) Allow the graphical login program to login directly as sysadm_r:sysadm_t # useradd <example_user> # passwd <example_user> Changing password for user <example_user> . New password: Retype new password: passwd: all authentication tokens updated successfully. id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 # useradd -Z staff_u <example_user> # passwd <example_user> Changing password for user <example_user> . New password: Retype new password: passwd: all authentication tokens updated successfully. id -Z uid=1000( <example_user> ) gid=1000( <example_user> ) groups=1000( <example_user> ) context=staff_u:staff_r:staff_t:s0-s0:c0.c1023 semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * semanage login -m -s user_u -r s0 __default__ semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ user_u s0 * root unconfined_u s0-s0:c0.c1023 * adduser <example_user> passwd <example_user> [ <example_user> @localhost ~]USD id -Z user_u:user_r:user_t:s0 [ <example_user> @localhost ~]USD ps axZ LABEL PID TTY STAT TIME COMMAND - 1 ? Ss 0:05 /usr/lib/systemd/systemd --switched-root --system --deserialize 18 - 3729 ? S 0:00 (sd-pam) user_u:user_r:user_t:s0 3907 ? Ss 0:00 /usr/lib/systemd/systemd --user - 3911 ? S 0:00 (sd-pam) user_u:user_r:user_t:s0 3918 ? S 0:00 sshd: <example_user> @pts/0 user_u:user_r:user_t:s0 3922 pts/0 Ss 0:00 -bash user_u:user_r:user_dbusd_t:s0 3969 ? Ssl 0:00 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only user_u:user_r:user_t:s0 3971 pts/0 R+ 0:00 ps axZ setsebool -P ssh_sysadm_login on adduser -G wheel -Z sysadm_u <example_user> usermod -G wheel -Z sysadm_u <example_user> restorecon -R -F -v /home/ <example_user> semanage login -l | grep <example_user> <example_user> sysadm_u s0-s0:c0.c1023 * [ <example_user> @localhost ~]USD id -Z sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 sudo -i [sudo] password for <example_user> : id -Z sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 systemctl restart sshd Failed to restart sshd.service: Access denied See system logs and 'systemctl status sshd.service' for details. adduser -G wheel -Z staff_u <example_user> usermod -G wheel -Z staff_u <example_user> restorecon -R -F -v /home/ <example_user> visudo -f /etc/sudoers.d/ <example_user> <example_user> ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL semanage login -l | grep <example_user> <example_user> staff_u s0-s0:c0.c1023 * [ <example_user> @localhost ~]USD sudo -i [sudo] password for <example_user> : id -Z staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 systemctl restart sshd Failed to restart sshd.service: Access denied See system logs and 'systemctl status sshd.service' for details. systemctl start httpd systemctl status httpd ... httpd[14523]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:3131 ... systemd[1]: Failed to start The Apache HTTP Server. ... semanage port -l | grep http http_cache_port_t tcp 8080, 8118, 8123, 10001-10010 http_cache_port_t udp 3130 http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989 semanage port -a -t http_port_t -p tcp 3131 systemctl start httpd wget localhost:3131/index.html ... HTTP request sent, awaiting response... 403 Forbidden ... sealert -l "*" SELinux is preventing httpd from getattr access on the file /var/test_www/html/index.html. ... matchpathcon /var/www/html /var/test_www/html /var/www/html system_u:object_r:httpd_sys_content_t:s0 /var/test_www/html system_u:object_r:var_t:s0 semanage fcontext -a -e /var/www /var/test_www restorecon -Rv /var/ Relabeled /var/test_www/html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0 Relabeled /var/test_www/html/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0 systemctl status httpd ... Active: active (running) ... systemd[1]: Started The Apache HTTP Server. httpd[14888]: Server configured, listening on: port 3131 ... wget localhost:3131/index.html ... HTTP request sent, awaiting response... 200 OK Length: 0 [text/html] Saving to: 'index.html' ... semanage boolean -l | grep 'nfs\|cifs' | grep httpd httpd_use_cifs (off , off) Allow httpd to access cifs file systems httpd_use_nfs (off , off) Allow httpd to access nfs file systems getsebool -a | grep 'nfs\|cifs' | grep httpd httpd_use_cifs --> off httpd_use_nfs --> off setsebool httpd_use_nfs on setsebool httpd_use_cifs on getsebool -a | grep 'nfs\|cifs' | grep httpd httpd_use_cifs --> on httpd_use_nfs --> on man -k selinux | grep samba samba_net_selinux (8) - Security Enhanced Linux Policy for the samba_net processes samba_selinux (8) - Security Enhanced Linux Policy for the smbd processes ... semanage fcontext -l | grep samba ... /var/cache/samba(/.*)? all files system_u:object_r:samba_var_t:s0 ... /var/spool/samba(/.*)? all files system_u:object_r:samba_spool_t:s0 ... sesearch -A | grep samba | grep httpd ... allow httpd_t cifs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True ... getsebool -a | grep homedirs git_cgi_enable_homedirs --> off git_system_enable_homedirs --> off httpd_enable_homedirs --> off mock_enable_homedirs --> off mpd_enable_homedirs --> off openvpn_enable_homedirs --> on ssh_chroot_rw_homedirs --> off sesearch -A | grep httpd_enable_homedirs ... allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_nfs_home_dirs && httpd_enable_homedirs ]:True allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True ... sesearch -A -s httpd_t -c file -p read ... allow httpd_t httpd_t:file { append getattr ioctl lock open read write }; allow httpd_t httpd_tmp_t:file { append create getattr ioctl link lock map open read rename setattr unlink write }; ... man user_selinux seinfo -x -a user_home_type Type Attributes: 1 attribute user_home_type; ... chrome_sandbox_home_t config_home_t cvs_home_t data_home_t dbus_home_t fetchmail_home_t gconf_home_t git_user_content_t ... semanage fcontext -l | grep data_home_t ... /root/\.local/share(/.*)? all files system_u:object_r:data_home_t:s0 ... semanage fcontext -a -t data_home_t '/shared-data(/.*)?' semanage fcontext -l | grep "shared-data" /shared-data(/.*)? all files system_u:object_r:data_home_t:s0 ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent journalctl -t setroubleshoot dmesg | grep -i -e type=1300 -e type=1400 semodule -DB semodule -B setenforce 0 getenforce Permissive sealert -l "*" SELinux is preventing /usr/bin/passwd from write access on the file /root/test. ***** Plugin leaks (86.2 confidence) suggests ***************************** If you want to ignore passwd trying to write access the test file, because you believe it should not need this access. Then you should report this as a bug. You can generate a local policy module to dontaudit this access. Do ausearch -x /usr/bin/passwd --raw | audit2allow -D -M my-passwd semodule -X 300 -i my-passwd.pp ***** Plugin catchall (14.7 confidence) suggests ************************** Raw Audit Messages type=AVC msg=audit(1553609555.619:127): avc: denied { write } for pid=4097 comm="passwd" path="/root/test" dev="dm-0" ino=17142697 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0 Hash: passwd,passwd_t,admin_home_t,file,write auditctl -w /etc/shadow -p w -k shadow-write rm -f /var/lib/setroubleshoot/setroubleshoot.xml auditctl -W /etc/shadow -p w -k shadow-write semanage fcontext -a -t httpd_sys_content_t "/srv/myweb(/.*)?" restorecon -R -v /srv/myweb USD matchpathcon -V /var/www/html/* /var/www/html/index.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0 /var/www/html/page1.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0 # restorecon -v /var/www/html/index.html restorecon reset /var/www/html/index.html context unconfined_u:object_r:user_home_t:s0->system_u:object_r:httpd_sys_content_t:s0 # restorecon -R -v /var/www/html/ restorecon reset /var/www/html/page1.html context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0 restorecon reset /var/www/html/index.html context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0 # setsebool -P httpd_can_network_connect_db on USD getsebool -a | grep ftp ftpd_anon_write --> off ftpd_full_access --> off ftpd_use_cifs --> off ftpd_use_nfs --> off ftpd_connect_db --> off httpd_enable_ftp_server --> off tftp_anon_write --> off # semanage port -l | grep http http_cache_port_t tcp 3128, 8080, 8118 http_cache_port_t udp 3130 http_port_t tcp 80, 443, 488, 8008, 8009, 8443 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989 # systemctl start httpd.service Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. # systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: failed (Result: exit-code) since Thu 2013-08-15 09:57:05 CEST; 59s ago Process: 16874 ExecStop=/usr/sbin/httpd USDOPTIONS -k graceful-stop (code=exited, status=0/SUCCESS) Process: 16870 ExecStart=/usr/sbin/httpd USDOPTIONS -DFOREGROUND (code=exited, status=1/FAILURE) type=AVC msg=audit(1225948455.061:294): avc: denied { name_bind } for pid=4997 comm="httpd" src=9876 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket # semanage port -a -t http_port_t -p tcp 9876 vim <local_module> .cil (allow cupsd_lpd_t cupsd_var_run_t (sock_file (read))) module local_cupslpd-read-cupssock 1.0; require { type cupsd_var_run_t; type cupsd_lpd_t; class sock_file read; } #============= cupsd_lpd_t ============== allow cupsd_lpd_t cupsd_var_run_t:sock_file read; semodule -i <local_module> .cil systemctl restart <service-name> semodule -lfull | grep "local_" 400 local_module cil sesearch -A --source= <SOURCENAME> --target= <TARGETNAME> --class= <CLASSNAME> --perm= <P1> , <P2> sesearch -A --source=cupsd_lpd_t --target=cupsd_var_run_t --class=sock_file --perm=read allow cupsd_lpd_t cupsd_var_run_t:sock_file { append getattr open read write }; systemctl status <service-name> ps -efZ | grep <process-name> ausearch -m AVC -i -ts recent <no matches> ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR type=AVC msg=audit(1395177286.929:1638): avc: denied { read } for pid=6591 comm="httpd" name="webpages" dev="0:37" ino=2112 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=AVC msg=audit(1226874073.147:96): avc: denied { getattr } for pid=2465 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file user_u:user_r:user_t:s1 dnf install selinux-policy-mls vi /etc/selinux/config SELINUX=permissive SELINUXTYPE=mls fixfiles -F onboot System will relabel on next boot reboot ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i SELINUX=enforcing reboot getenforce Enforcing sestatus | grep mls Loaded policy name: mls setenforce 0 semanage user -m -L s1 -r s1-s15 staff_u genhomedircon restorecon -R -F -v /home/ Relabeled /home/staff from staff_u:object_r:user_home_dir_t:s0 to staff_u:object_r:user_home_dir_t:s1 Relabeled /home/staff/.bash_logout from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1 Relabeled /home/staff/.bash_profile from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1 Relabeled /home/staff/.bashrc from staff_u:object_r:user_home_t:s0 to staff_u:object_r:user_home_t:s1 semanage login -m -r s1 example_user chcon -R -l s1 /home/ example_user setenforce 1 semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ user_u s0-s0 * example_user user_u s1 * ... id -Z user_u:user_r:user_t: s0-s2 id -Z user_u:user_r:user_t: s1-s2 newrole -l s1 id -Z user_u:user_r:user_t: s1-s2 exit id -Z user_u:user_r:user_t: s0-s2 newrole -l s1-s2 id -Z user_u:user_r:user_t: s1-s2 ls -Z /path/to/file user_u:object_r:user_home_t: s0 /path/to/file touch /path/to/file exit ls -Z /path/to/file user_u:object_r:user_home_t: s1 /path/to/file ls -lZ /path/to/file -rw-r-----. 1 User1 User1 user_u:object_r:user_home_t: s1 0 12. Feb 10:43 /path/to/file semanage fcontext -a -r s2 /path/to/file restorecon -F -v /path/to/file Relabeled /path/to/file from user_u:object_r:user_home_t: s1 to user_u:object_r:user_home_t:s2 ls -lZ /path/to/file -rw-r-----. 1 User1 User1 user_u:object_r:user_home_t: s2 0 12. Feb 10:53 /path/to/file cat /path/to/file cat: file: Permission denied visudo -f /etc/sudoers.d/ <sec_adm_user> <sec_adm_user> ALL=(ALL) TYPE=secadm_t ROLE=secadm_r ALL id uid=1000( <sec_adm_user> ) gid=1000( <sec_adm_user> ) groups=1000( <sec_adm_user> ) context=staff_u:staff_r:staff_t:s0-s15:c0.c1023 sudo -i [sudo] password for <sec_adm_user> : id uid=0(root) gid=0(root) groups=0(root) context=staff_u:secadm_r:secadm_t:s0-s15:c0.c1023 semodule -d sysadm_secadm seinfo -xt secadm_t Types: 1 type secadm_t, can_relabelto_shadow_passwords, (...) userdomain; logout logout Connection to localhost closed. id uid=0(root) gid=0(root) groups=0(root) context=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 semodule -e sysadm_secadm SELinux: Could not load policy file /etc/selinux/mls/policy/policy.31: Permission denied /sbin/load_policy: Can't load policy: Permission denied libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory). SELinux: Could not load policy file /etc/selinux/mls/policy/policy.31: Permission denied /sbin/load_policy: Can't load policy: Permission denied libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory). semodule: Failed! seinfo -xt sysadm_t [Errno 13] Permission denied: '/sys/fs/selinux/policy' console_device_t sysadm_tty_device_t user_tty_device_t staff_tty_device_t auditadm_tty_device_t secureadm_tty_device_t ls -Z `tty` root:object_r: user_devpts_t :s0 /dev/pts/0 setenforce 1 setenforce 0 (typeattributeset mlsfilewrite (_staff_t_)) semodule -i ~/ local_mlsfilewrite .cil setenforce 1 semodule -lfull | grep "local_mls" 400 local_mlsfilewrite cil user_u:user_r:user_t:s1:c2 vim local_mcs_user.cil (typeattributeset mcs_constrained_type (user_t)) semodule -i local_mcs_user.cil seinfo -xt user_t Types: 1 type user_t, application_domain_type, nsswitch_domain, corenet_unlabeled_type, domain, kernel_system_state_reader, mcs_constrained_type , netlabel_peer_type, privfd, process_user_target, scsi_generic_read, scsi_generic_write, syslog_client_type, pcmcia_typeattr_1, user_usertype, login_userdomain, userdomain, unpriv_userdomain, userdom_home_reader_type, userdom_filetrans_type, xdmhomewriter, x_userdomain, x_domain, dridomain, xdrawable_type, xcolormap_type; vi /etc/selinux/targeted/setrans.conf s0:c0=Marketing s0:c1=Finance s0:c2=Payroll s0:c3=Personnel systemctl restart mcstrans chcat -L s0:c0 Marketing s0:c1 Finance s0:c2 Payroll s0:c3 Personnel s0 s0-s0:c0.c1023 SystemLow-SystemHigh s0:c0.c1023 SystemHigh semanage user -m -rs0:c0,c1-s0:c0.c9 <user_u> semanage login -m -rs0:c1 <Linux.user1> chcat -l -- + <category1> ,- <category2> <Linux.user1> , <Linux.user2> chcat -L -l <Linux.user1> , <Linux.user2> <Linux.user1> : <category1> , <category2> <Linux.user2> : <category1> , <category2> chcat -- + <category1> ,+ <category2> <path/to/file1> chcat -- - <category1> ,- <category2> <path/to/file1> ls -lZ <path/to/file> -rw-r--r-- <LinuxUser1> <Group1> root:object_r:user_home_t:_<sensitivity>_:_<category>_ <path/to/file> cat <path/to/file> cat: <path/to/file> : Permission Denied ALLOW apache_process apache_log:FILE READ; ls -Z /etc/passwd system_u:object_r:passwd_file_t:s0 /etc/passwd vi mydaemon.c #include <unistd.h> #include <stdio.h> FILE *f; int main(void) { while(1) { f = fopen("/var/log/messages","w"); sleep(5); fclose(f); } } gcc -o mydaemon mydaemon.c vi mydaemon.service [Unit] Description=Simple testing daemon [Service] Type=simple ExecStart=/usr/local/bin/mydaemon [Install] WantedBy=multi-user.target cp mydaemon /usr/local/bin/ cp mydaemon.service /usr/lib/systemd/system systemctl start mydaemon systemctl status mydaemon ● mydaemon.service - Simple testing daemon Loaded: loaded (/usr/lib/systemd/system/mydaemon.service; disabled; vendor preset: disabled) Active: active (running) since Sat 2020-05-23 16:56:01 CEST; 19s ago Main PID: 4117 (mydaemon) Tasks: 1 Memory: 148.0K CGroup: /system.slice/mydaemon.service └─4117 /usr/local/bin/mydaemon May 23 16:56:01 localhost.localdomain systemd[1]: Started Simple testing daemon. ps -efZ | grep mydaemon system_u:system_r:unconfined_service_t:s0 root 4117 1 0 16:56 ? 00:00:00 /usr/local/bin/mydaemon sepolicy generate --init /usr/local/bin/mydaemon Created the following files: /home/example.user/mysepol/mydaemon.te # Type Enforcement file /home/example.user/mysepol/mydaemon.if # Interface file /home/example.user/mysepol/mydaemon.fc # File Contexts file /home/example.user/mysepol/mydaemon_selinux.spec # Spec file /home/example.user/mysepol/mydaemon.sh # Setup Script ./mydaemon.sh Building and Loading Policy + make -f /usr/share/selinux/devel/Makefile mydaemon.pp Compiling targeted mydaemon module Creating targeted mydaemon.pp policy package rm tmp/mydaemon.mod.fc tmp/mydaemon.mod + /usr/sbin/semodule -i mydaemon.pp restorecon -v /usr/local/bin/mydaemon /usr/lib/systemd/system systemctl restart mydaemon ps -efZ | grep mydaemon system_u:system_r:mydaemon_t:s0 root 8150 1 0 17:18 ? 00:00:00 /usr/local/bin/mydaemon ausearch -m AVC -ts recent type=AVC msg=audit(1590247112.719:5935): avc: denied { open } for pid=8150 comm="mydaemon" path="/var/log/messages" dev="dm-0" ino=2430831 scontext=system_u:system_r:mydaemon_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file permissive=1 sealert -l "*" SELinux is preventing mydaemon from open access on the file /var/log/messages. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that mydaemon should be allowed open access on the messages file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: ausearch -c 'mydaemon' --raw | audit2allow -M my-mydaemon semodule -X 300 -i my-mydaemon.pp Additional Information: Source Context system_u:system_r:mydaemon_t:s0 Target Context unconfined_u:object_r:var_log_t:s0 Target Objects /var/log/messages [ file ] Source mydaemon ... ausearch -m AVC -ts recent | audit2allow -R require { type mydaemon_t; } #============= mydaemon_t ============== logging_write_generic_logs(mydaemon_t) macro-expander "logging_write_generic_logs(mydaemon_t)" allow mydaemon_t var_t:dir { getattr search open }; allow mydaemon_t var_log_t:dir { getattr search open read lock ioctl }; allow mydaemon_t var_log_t:dir { getattr search open }; allow mydaemon_t var_log_t:file { open { getattr write append lock ioctl } }; allow mydaemon_t var_log_t:dir { getattr search open }; allow mydaemon_t var_log_t:lnk_file { getattr read }; echo "logging_write_generic_logs(mydaemon_t)" >> mydaemon.te echo "allow mydaemon_t var_log_t:file { open write getattr };" >> mydaemon.te ./mydaemon.sh Building and Loading Policy + make -f /usr/share/selinux/devel/Makefile mydaemon.pp Compiling targeted mydaemon module Creating targeted mydaemon.pp policy package rm tmp/mydaemon.mod.fc tmp/mydaemon.mod + /usr/sbin/semodule -i mydaemon.pp ps -efZ | grep mydaemon system_u:system_r:mydaemon_t:s0 root 8150 1 0 17:18 ? 00:00:00 /usr/local/bin/mydaemon ausearch -m AVC -ts recent <no matches> dnf install -y udica dnf module install -y container-tools podman run --env container=podman -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 37a3635afb8f registry.access.redhat.com/ubi8:latest bash 15 minutes ago Up 15 minutes ago heuristic_lewin podman inspect 37a3635afb8f > container.json udica -j container.json my_container Policy my_container with container id 37a3635afb8f created! [...] podman inspect 37a3635afb8f | udica my_container Policy my_container with container id 37a3635afb8f created! Please load these modules using: semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil} Restart the container with: "--security-opt label=type:my_container.process" parameter semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil} podman stop 37a3635afb8f podman run --security-opt label=type: my_container .process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash ps -efZ | grep my_container .process unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 2275 434 1 13:49 pts/1 00:00:00 podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash system_u:system_r:my_container.process:s0:c270,c963 root 2317 2305 0 13:49 pts/0 00:00:00 bash cd /home ls username cd /var/spool/ touch test dnf install nmap-ncat nc -lvp 21 ... Ncat: Listening on :::21 Ncat: Listening on 0.0.0.0:21 ^C nc -lvp 80 ... Ncat: bind to :::80: Permission denied. QUITTING. cp /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml <my-selinux-playbook.yml> vi <my-selinux-playbook.yml> selinux_modules: - { path: "selinux-local-1.pp", priority: "400" } ansible-playbook <my-selinux-playbook.yml> --syntax-check ansible-playbook <my-selinux-playbook.yml> - name: Allow Apache to listen on tcp port <port_number> community.general.seport: ports: <port_number> proto: tcp setype: http_port_t state: present --- - name: Modify SELinux port mapping example hosts: all vars: # Map tcp port <port_number> to the 'http_port_t' SELinux port type selinux_ports: - ports: <port_number> proto: tcp setype: http_port_t state: present tasks: - name: Include selinux role ansible.builtin.include_role: name: rhel-system-roles.selinux semanage port --list | grep http_port_t http_port_t tcp <port_number> , 80, 81, 443, 488, 8008, 8009, 8443, 9000 semanage export -f ./ my-selinux-settings.mod scp ./ my-selinux-settings.mod new-system-hostname : ssh root@ new-system-hostname new-system-hostname # semanage import -f ./ my-selinux-settings.mod setsebool -P allow_polyinstantiation 1 mkdir /tmp-inst /var/tmp/tmp-inst --mode 000 restorecon -Fv /tmp-inst /var/tmp/tmp-inst Relabeled /tmp-inst from unconfined_u:object_r:default_t:s0 to system_u:object_r:tmp_t:s0 Relabeled /var/tmp/tmp-inst from unconfined_u:object_r:tmp_t:s0 to system_u:object_r:tmp_t:s0 allow_filesystem_mark = 1 /tmp /tmp-inst/ level root,adm /var/tmp /var/tmp/tmp-inst/ level root,adm USDHOME USDHOME/USDUSER.inst/ level /tmp /tmp-inst/ user root,adm /var/tmp /var/tmp/tmp-inst/ user root,adm USDHOME USDHOME/USDUSER.inst/ user grep namespace /etc/pam.d/login session required pam_namespace.so AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat AuthorizedKeysCommandRunAs root grep -r PubkeyAuthentication /etc/ssh/ /etc/ssh/sshd_config:#PubkeyAuthentication yes [...] session include system-auth session required pam_namespace.so unmnt_remnt [...] findmnt --mountpoint /tmp/ TARGET SOURCE FSTYPE OPTIONS /tmp /dev/vda1[/tmp-inst/ <user> ] xfs rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota