Please enable JavaScript.

Coggle requires JavaScript to display documents.

🔐 SELinux (Security-Enhanced Linux) Enterprise Implementation, SELinux…

- - - - Traditional Linux permission model
    - - File owner
      - Group owner
      - Permission bits
    - - ls -l /etc/passwd
      - -rw-r--r--
      - owner
      - group
      - others
    - - Root user can bypass permissions
      - Compromised service can access files
  - - - Security decisions controlled by security policy
    - - SELinux policy engine
    - - Apache service can access web files
      - Apache service cannot access user home directories
  - - - Access based on user roles
    - - Security administrator role
      - Database administrator role
  - - - Every process and object has a security type
- - - - Linux Kernel
    - - Enforces SELinux decisions
  - - - Cache storing security decisions
    - - Improves SELinux performance
  - - - /etc/selinux/
    - - Rules
      - Context definitions
      - Boolean settings
  - - - ↓
    - - ↓
    - - ↓
    - - ↓
- - - - SELinux active and blocking violations
    - - getenforce
    - - Enforcing
  - - - SELinux logs violations but does not block
    - - Troubleshooting
    - - setenforce 0
  - - - SELinux completely turned off
    - - sestatus
    - - /etc/selinux/config
    - - SELINUX=disabled
- - - - /etc/selinux/config
    - - SELINUX=enforcing
      - SELINUXTYPE=targeted
  - - - /etc/selinux/
  - - - sestatus
- - - - Default enterprise policy
      - Protects important services
      - Examples
        
        Apache
        
        SSH
        
        DNS
        
        Database
    - - Multi Level Security
      - Used in
        
        Military
        
        Government
    - - Minimal security rules
- - - - system_u
      - Defines SELinux identity
    - - object_r
      - Defines role permission
    - - httpd_sys_content_t
      - Most important part
    - - s0
      - Used for MLS security
- - - - ls -Z
  - - - chcon
    - - chcon -t httpd_sys_content_t file.html
    - - Lost after restore or relabel
  - - - semanage
    - - semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
    - - restorecon -Rv /web
- - - - ps -eZ
  - - - Apache is running under SELinux domain
- - - - httpd_t
    - - mysqld_t
- - - - Read web content
    - - Read and write web content
    - - SSH related files
    - - Database files
    - - Log files
    - - Executable binaries
- - - - setsebool -P httpd_can_network_connect on
- - - - tcp 80
      - tcp 443
- - - - Files
    - - Services
- - - - apt install selinux-utils policycoreutils
    - - dnf install policycoreutils policycoreutils-python-utils
- - - - Identify denial
    - - Understand reason
    - - Create correct context
    - - Enable required boolean
    - - Test
- - - - auditd
    - - /var/log/audit/audit.log
- - - - httpd
- - - - /var/lib/mysql
- - - - PCI-DSS
      - ISO 27001
      - NIST Cybersecurity Framework
      - CIS Benchmarks
  - - - Discretionary Access Control (DAC)
      - User controls permissions
      - Owner can change permissions
      - Example:
        
        chmod
        
        chown
    - - Mandatory Access Control (MAC)
      - Security policy controls access
      - Users cannot bypass policy
      - Root user can also be restricted
  - - - Integrated into Linux kernel
      - Enforces security decisions
    - - Collection of security rules
      - Defines allowed and denied actions
    - - Security context attached to files
      - Processes
      - Ports
      - Network objects
    - - Tools used to manage SELinux
      - Examples:
        
        sestatus
        
        restorecon
        
        semanage
        
        setsebool
        
        audit2allow
- - - - SELinux policy is active
      - Access violations are blocked
      - Enterprise production mode
    - - sestatus
    - - SELinux status: enabled
      - Current mode: enforcing
  - - - SELinux logs violations
      - Does not block access
    - - Testing new applications
      - Troubleshooting policy problems
    - - setenforce 0
  - - - SELinux completely turned off
    - - sestatus
- - - - /etc/selinux/config
    - - Controls SELinux startup mode
    - - SELINUX=enforcing
      - SELINUXTYPE=targeted
  - - - /etc/selinux/
    - - targeted policy
      - minimum policy
      - mls policy
- - - - Apache
      - SSH
      - DNS
      - Database services
  - - - Military systems
      - Government systems
- - - - SELinux label attached to objects
    - - user:role:type:level
  - - - Defines SELinux identity
      - Example:
        
        system_u
    - - Defines role permissions
      - Example:
        
        object_r
    - - Main access control component
      - Example:
        
        httpd_sys_content_t
    - - Security classification
      - Example:
        
        s0
- - - - Which process can access which object
  - - - httpd_t
    - - httpd_sys_content_t
    - - httpd_t can read httpd_sys_content_t
  - - - Apache compromised
      - Attacker reads:
        
        /etc/passwd
        
        database files
    - - Apache restricted
      - Access denied
- - - - /etc/passwd
    - - bilal
  - - - semanage login
    - - staff_u
  - - - bilal
    - - staff_u
- - - - setsebool -P httpd_can_network_connect on
  - - - Apache can connect network
    - - Apache can access user home directories
    - - FTP access control
- - - - restorecon -Rv /var/www/html
  - - - chcon -t httpd_sys_content_t file
  - - - semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
    - - restorecon -Rv /web
- - - - Apache running on port 8080
    - - semanage port -a -t http_port_t -p tcp 8080
- - - - /var/log/audit/audit.log
  - - - Access Vector Cache
  - - - audit2allow -a
    - - Use carefully
      - Do not blindly allow everything
- - - - dnf install policycoreutils selinux-utils
  - - - sestatus
  - - - setenforce 1
  - - - Apache
      - SSH
      - Database
  - - - restorecon
- - - - httpd_t
    - - httpd_sys_content_t
    - - /var/log/httpd/
  - - - sshd_t
    - - /etc/ssh/
  - - - mysqld_t
    - - postgres_t
- - - - Elastic SIEM
      - Splunk
      - QRadar