Please enable JavaScript.

Coggle requires JavaScript to display documents.

SELinux Enterprise Implementation (Security-Enhanced Linux), SELinux…

- - - - PCI-DSS
      - ISO 27001
      - NIST Cybersecurity Framework
      - CIS Benchmarks
  - - - Discretionary Access Control (DAC)
      - User controls permissions
      - Owner can change permissions
      - Example:
        
        chmod
        
        chown
    - - Mandatory Access Control (MAC)
      - Security policy controls access
      - Users cannot bypass policy
      - Root user can also be restricted
  - - - Integrated into Linux kernel
      - Enforces security decisions
    - - Collection of security rules
      - Defines allowed and denied actions
    - - Security context attached to files
      - Processes
      - Ports
      - Network objects
    - - Tools used to manage SELinux
      - Examples:
        
        sestatus
        
        restorecon
        
        semanage
        
        setsebool
        
        audit2allow
- - - - SELinux policy is active
      - Access violations are blocked
      - Enterprise production mode
    - - sestatus
    - - SELinux status: enabled
      - Current mode: enforcing
  - - - SELinux logs violations
      - Does not block access
    - - Testing new applications
      - Troubleshooting policy problems
    - - setenforce 0
  - - - SELinux completely turned off
    - - sestatus
- - - - /etc/selinux/config
    - - Controls SELinux startup mode
    - - SELINUX=enforcing
      - SELINUXTYPE=targeted
  - - - /etc/selinux/
    - - targeted policy
      - minimum policy
      - mls policy
- - - - Apache
      - SSH
      - DNS
      - Database services
  - - - Military systems
      - Government systems
- - - - SELinux label attached to objects
    - - user:role:type:level
  - - - Defines SELinux identity
      - Example:
        
        system_u
    - - Defines role permissions
      - Example:
        
        object_r
    - - Main access control component
      - Example:
        
        httpd_sys_content_t
    - - Security classification
      - Example:
        
        s0
- - - - Which process can access which object
  - - - httpd_t
    - - httpd_sys_content_t
    - - httpd_t can read httpd_sys_content_t
  - - - Apache compromised
      - Attacker reads:
        
        /etc/passwd
        
        database files
    - - Apache restricted
      - Access denied
- - - - /etc/passwd
    - - bilal
  - - - semanage login
    - - staff_u
  - - - bilal
    - - staff_u
- - - - setsebool -P httpd_can_network_connect on
  - - - Apache can connect network
    - - Apache can access user home directories
    - - FTP access control
- - - - restorecon -Rv /var/www/html
  - - - chcon -t httpd_sys_content_t file
  - - - semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
    - - restorecon -Rv /web
- - - - Apache running on port 8080
    - - semanage port -a -t http_port_t -p tcp 8080
- - - - /var/log/audit/audit.log
  - - - Access Vector Cache
  - - - audit2allow -a
    - - Use carefully
      - Do not blindly allow everything
- - - - dnf install policycoreutils selinux-utils
  - - - sestatus
  - - - setenforce 1
  - - - Apache
      - SSH
      - Database
  - - - restorecon
- - - - httpd_t
    - - httpd_sys_content_t
    - - /var/log/httpd/
  - - - sshd_t
    - - /etc/ssh/
  - - - mysqld_t
    - - postgres_t
- - - - Elastic SIEM
      - Splunk
      - QRadar
- - - - SELinux policy is fully active
      - SELinux checks every access request
      - Unauthorized actions are blocked
      - Security violations are logged
    - - Production servers
      - Database servers
      - Web servers
      - Application servers
      - Critical infrastructure
    - - Process requests access
        
        ↓
      - SELinux checks policy
        
        ↓
      - Policy allows
        
        ↓
      - Access granted
      - Policy denies
        
        ↓
      - Access blocked
      - Event logged
    - - Command:
        
        sestatus
      - Example:
        
        SELinux status: enabled
        
        SELinuxfs mount: /sys/fs/selinux
        
        SELinux root directory: /etc/selinux
        
        Loaded policy name: targeted
        
        Current mode: enforcing
    - - Command:
        
        getenforce
      - Output:
        
        Enforcing
    - - Command:
        
        sudo setenforce 1
      - Explanation:
        
        setenforce
        
        Command to change SELinux runtime mode
        
        1
        
        Means enable enforcement
    - - getenforce
      - Output:
        
        Enforcing
    - - Apache Web Server
        
        Process:
        
        httpd
        
        SELinux Context:
        
        system_u:
        
        system_r:
        
        httpd_t
        
        Apache tries:
        
        Read website files
        
        ↓
        
        SELinux checks:
        
        httpd_t policy
        
        Allowed:
        
        /var/www/html
        
        Denied:
        
        /home/user/private
        
        Result:
        
        Allowed access works
        
        Unauthorized access blocked
    - - SELinux violations stored in:
        
        /var/log/audit/audit.log
      - View logs:
        
        sudo cat /var/log/audit/audit.log
      - Search SELinux denials:
        
        sudo ausearch -m AVC
      - AVC Meaning:
        
        Access Vector Cache
        
        Records SELinux access denial events
  - - - SELinux policy remains loaded
      - SELinux checks access requests
      - Violations are NOT blocked
      - Violations are only logged
    - - Application testing
      - Migration projects
      - Troubleshooting SELinux problems
      - Creating custom SELinux policies
    - - Process requests access
        
        ↓
      - SELinux checks policy
        
        ↓
      - Policy allows
        
        ↓
      - Access granted
      - Policy denies
        
        ↓
      - Access allowed
        
        ↓
      - Warning logged
    - - Command:
        
        sudo setenforce 0
      - Explanation:
        
        setenforce
        
        Changes SELinux runtime mode
        
        0
        
        Disable enforcement
    - - getenforce
      - Output:
        
        Permissive
    - - Problem:
        
        New application cannot start
      - Administrator changes:
        
        Enforcing
        
        ↓
        
        Permissive
      - Command:
        
        sudo setenforce 0
      - Test application
      - Check logs:
        
        sudo ausearch -m AVC
      - Find missing permissions
      - Create policy
      - Return:
        
        sudo setenforce 1
    - - Permissive is NOT disabled
      - SELinux still:
        
        Loads policies
        
        Logs violations
        
        Generates audit events
  - - - SELinux completely turned off
      - Kernel does not enforce SELinux security
      - No SELinux policy loaded
    - - Command:
        
        sestatus
      - Output:
        
        SELinux status:
        
        disabled
    - - Permissive:
        
        SELinux active
        
        Policies loaded
        
        Logs violations
        
        Does not block
      - Disabled:
        
        SELinux inactive
        
        No policy checking
        
        No SELinux logs
    - - Generally avoided
      - Reasons:
        
        Removes mandatory access control
        
        Reduces security protection
        
        May violate compliance requirements
    - - Not recommended
      - Configuration file:
        
        /etc/selinux/config
      - Edit:
        
        sudo vi /etc/selinux/config
      - Change:
        
        SELINUX=disabled
    - - Path:
        
        /etc/selinux/config
      - Available settings:
        
        SELINUX=enforcing
        
        SELINUX=permissive
        
        SELINUX=disabled
- - - - setenforce 1
    - - setenforce 0
  - - - /etc/selinux/config
    - - sudo nano /etc/selinux/config
    - - SELINUX=enforcing
- - - - Apache
      - SSH
      - DNS
      - Database
      - FTP
- - - - sestatus
  - - - getenforce
  - - - ausearch -m AVC
  - - - restorecon
  - - - audit2allow
- - - - Enforcing
  - - - Permissive