Please enable JavaScript.
Coggle requires JavaScript to display documents.
🔐 SELinux Enterprise Implementation Master Map, SELinux Role Comparison,…
🔐 SELinux Enterprise Implementation Master Map
🔐 SELinux Enterprise Implementation Master Map
1️⃣ SELinux Users
📌 Concept
SELinux User
SELinux user is an identity used by SELinux policy engine
It is different from normal Linux user account
Linux user = /etc/passwd identity
SELinux user = security identity controlled by SELinux policy
Purpose
Defines what security roles a Linux user can access
Controls user domain transitions
Provides Mandatory Access Control protection
Linux User Mapping
Linux users are mapped to SELinux users
Command
semanage login -l
Example Output
Login Name
SELinux User
root
unconfined_u
user1
user_u
🛠 SELinux User Management
View SELinux users
Command
semanage user -l
Shows
SELinux user name
Allowed roles
MLS/MCS levels
Create SELinux user
Command
semanage user -a -R "staff_r sysadm_r" company_admin_u
Command
semanage user -a -R "staff_r sysadm_r" company_admin_u
semanage
SELinux policy management tool
Manages:
Users
Roles
File contexts
Ports
Booleans
user
Manage SELinux Users
-a
Add new SELinux user
-R
Assign SELinux Roles
staff_r
1 more item...
sysadm_r
2 more items...
company_admin_u
Custom SELinux User
Created in SELinux policy database
Not a Linux user account
Verify
semanage user -l
Mapping Linux User
Create Linux user
useradd companyadmin
Map Linux user to SELinux user
semanage login -a -s company_admin_u companyadmin
Check
semanage login -l
Output
company_admin bilal_selinux_admin s0 *
S0
Mean
1 more item...
Authentication Flow
Linux User
company_admin_u
2 more items...
Explanation
-a
Add new SELinux user
-R
Assign roles
company_admin_u
New SELinux identity
Map Linux user to SELinux user
Command
semanage login -a -s company_admin_u bilal
Meaning
Linux user
bilal
SELinux identity
company_admin_u
Verify mapping
Command
semanage login -l
🏢 Enterprise Example
Administrator Account
Linux Account
bilal
SELinux Account
sysadmin_u
Allowed Roles
sysadm_r
Purpose
Restrict administrator capabilities
2️⃣ SELinux Roles
📌 Concept
Role Based Access Control
Role decides:
Which domains a user can enter
Relationship
SELinux User
↓
Role
↓
Domain
Default Roles
object_r
Used for files and objects
system_r
Used by system services
sysadm_r
Security administrator role
staff_r
Normal administrative role
user_r
Standard user role
🛠 View Roles
Command
seinfo -r
Example
sysadm_r
staff_r
user_r
Assign Role
Command
semanage user -m -R "sysadm_r" admin_u
Enterprise Usage
Security Administrator
User
security_admin_u
Role
sysadm_r
Purpose
Manage SELinux configuration
3️⃣ Type Enforcement
Type Enforcement controls which process can access which resource and what actions it can perform.
📌 Concept
Type Enforcement is the core SELinux security mechanism
Every object receives a security label
SELinux decides access based on:
Subject
Process
Object
File
Directory
Port
Device
Type
Security label
Security Context Format
user:role:type:level
Example
system_u:object_r:httpd_sys_content_t:s0
SELinux_user Role Type Security Level
Explanation
system_u
SELinux user
object_r
Role
httpd_sys_content_t
Type
s0
Security level
SELinux does not trust Linux users alone. It checks
Can do what (Role)
↓
To which object (Type)
↓
Who (SELinux User)
↓
With what permission (Allow Rule)
↓
Security Label
every process and every object has a security label
1️⃣ SELinux User
are different than normal user
system_u
user_u
staff_u
sysadm_u
2️⃣ SELinux Role
Roles are mainly important for processes and users
Role
object_r
Used for
Files and objects
Role
system_r
Used for
Processes
Role
staff_r
Used for
Normal users
Role
sysadm_r
Used for
System administrators
3️⃣ SELinux Type (Most Important)
SELinux Label
OR finding Type
View Context
Files
ls -Z
ls -Z /var/www/html/index.html
Processes
ps -eZ
ps -eZ | grep apache2
Ports
semanage port -l
Example
Apache Process
httpd_t
Website Files
httpd_sys_content_t
Allowed
httpd_t
can read
httpd_sys_content_t
4️⃣ SELinux Boolean Management
📌 Concept
Boolean is a switch controlling SELinux policy behavior
Enable or disable optional security rules
View Booleans
Command
getsebool -a
Example
Allow Apache network connection
getsebool httpd_can_network_connect
Enable Boolean
Temporary
setsebool httpd_can_network_connect on
Permanent
setsebool -P httpd_can_network_connect on
List Important Enterprise Booleans
Apache
httpd_can_network_connect
FTP
allow_ftpd_full_access
Database
httpd_can_network_connect_db
Configuration Location
/sys/fs/selinux/booleans/
5️⃣ File Context Management
📌 Concept
File context defines SELinux labels for files and directories
View Context
Command
ls -Z /var/www/html
Example
Wrong Label
default_t
Correct Apache Label
httpd_sys_content_t
Change Context
Temporary
chcon -t httpd_sys_content_t file.html
Permanent
semanage fcontext -a -t httpd_sys_content_t "/website(/.*)?"
restorecon -Rv /website
Important Paths
Policy Database
/etc/selinux/targeted/contexts/files/
Custom Rules
/etc/selinux/targeted/contexts/files/file_contexts.local
Enterprise Practice
Never use chcon permanently
Always use
semanage fcontext
restorecon
6️⃣ Port Labeling
📌 Concept
SELinux controls network ports also
View Ports
semanage port -l
Example
Apache Default
tcp 80
http_port_t
Add Custom Port
Example Apache on 8080
semanage port -a -t http_port_t -p tcp 8080
Verify
semanage port -l | grep http
Remove Port
semanage port -d -t http_port_t -p tcp 8080
7️⃣ Custom SELinux Policy
📌 Concept
Used when existing SELinux policy blocks legitimate application behavior
Policy Components
Type
Security label
Domain
Process security boundary
Allow Rule
Permission definition
Policy Development Tools
Install
dnf install selinux-policy-devel policycoreutils-devel
Create Module
audit2allow
semodule
Compile
make
Install
semodule -i application.pp
Policy Location
/etc/selinux/
/usr/share/selinux/packages/
8️⃣ Audit2allow
📌 Concept
Converts SELinux denial logs into policy rules
SELinux Denial Location
/var/log/audit/audit.log
Search Denials
ausearch -m AVC
Generate Policy
audit2allow -a -M custom_policy
Output
custom_policy.te
custom_policy.pp
Install
semodule -i custom_policy.pp
Enterprise Rule
Never directly allow everything
Analyze every AVC denial before creating policy
9️⃣ SELinux with Apache
Installation
dnf install httpd
Service
systemctl start httpd
Apache Process Context
httpd_t
Website Directory
/var/www/html
File Label
httpd_sys_content_t
Commands
restorecon -Rv /var/www/html
Allow Uploads
httpd_sys_rw_content_t
Network
semanage port -a -t http_port_t -p tcp 8080
Troubleshooting
ausearch -m AVC -ts recent
🔟 SELinux with Nginx
Process Domain
nginx_t
Website Path
/usr/share/nginx/html
Label
httpd_sys_content_t
Restore
restorecon -Rv /usr/share/nginx/html
Check
ps -eZ | grep nginx
Troubleshooting
ausearch -m AVC
1️⃣1️⃣ SELinux with MariaDB
Process Domain
mysqld_t
Database Path
/var/lib/mysql
Label
mysqld_db_t
Check
ls -Zd /var/lib/mysql
Restore
restorecon -Rv /var/lib/mysql
Allow Network
setsebool -P mysql_connect_any on
Ports
semanage port -l | grep mysql
1️⃣2️⃣ SELinux in Containers
📌 Concept
SELinux protects container workloads
Container Labels
container_t
container_file_t
Check
ps -eZ
Docker Volume Example
docker run
-v /data:/data:z
Meaning
:z
Shared SELinux label
:Z
Private SELinux label
Container Policy
container-selinux package
1️⃣3️⃣ SELinux Troubleshooting in SOC Environment
Incident Flow
Step 1
Identify application failure
Step 2
Check SELinux status
sestatus
Step 3
Check AVC denial
ausearch -m AVC
Step 4
Analyze denial
sealert -a /var/log/audit/audit.log
Step 5
Fix
Restore context
Enable boolean
Create policy
Important Logs
/var/log/audit/audit.log
/var/log/messages
Important Commands
sestatus
getenforce
setenforce
restorecon
semanage
audit2why
audit2allow
semodule
sealert
Enterprise SOC Checklist
Verify SELinux Enabled
Check AVC Alerts
Validate File Context
Review Boolean Changes
Review Custom Policies
Monitor Unauthorized Domain Transitions
Maintain Change Records
Labels
🛡️ SELinux Enterprise Label Management (Complete Implementation)
1️⃣ SELinux Foundation Concepts
🔹 What is SELinux?
SELinux = Security Enhanced Linux
Purpose:
Mandatory Access Control (MAC)
Controls what users, processes, and files can access
Traditional Linux Security:
User permissions
Group permissions
File ownership
rwx permissions
SELinux Adds:
Identity control
Role control
Type Enforcement
Security Levels
🔹 SELinux Decision Model
Every access request has:
Subject
↓
Process
Example:
httpd
sshd
nginx
Object
↓
Resource being accessed
Example:
File
Directory
Port
Socket
Policy Check
SELinux asks:
Is this process allowed to access this object?
Result:
Allow
OR
Deny
🔹 SELinux Status Checking
Command:
sestatus
Example output:
SELinux status:
enabled
Current mode:
enforcing
Modes:
Enforcing
SELinux blocks unauthorized actions
Permissive
SELinux logs violations but allows
Disabled
SELinux completely off
2️⃣ File Labels (File Context Labels)
📁 Purpose
File labels define:
What type of data a file contains
Which SELinux domains can access it
📌 File Label Structure
system_u:object_r:httpd_sys_content_t:s0
Breakdown:
SELinux User
system_u
Means:
SELinux identity assigned to object
Role
object_r
Means:
This object is controlled as a file object
Type
httpd_sys_content_t
Most important part
Used by Type Enforcement
Security Level
s0
MLS/MCS level
🔍 Find File Labels
Command:
ls -Z
Example:
ls -Z /var/www/html/index.html
Output:
system_u:object_r:httpd_sys_content_t:s0
🔍 Find Directory Labels
Command:
ls -Zd /var/www/html
🔍 Find Complete File Context Database
Command:
semanage fcontext -l
📂 Default SELinux File Context Database
Location:
/etc/selinux/targeted/contexts/files/file_contexts
Custom Rules:
/etc/selinux/targeted/contexts/files/file_contexts.local
🏢 Enterprise Example
Apache Website
Directory:
/var/www/html
Required Label:
httpd_sys_content_t
Check:
ls -Z /var/www/html
Wrong Example:
user_home_t
Result:
Apache cannot read file
🛠️ Create Custom File Label
Create directory:
mkdir /company_web
Check label:
ls -Zd /company_web
Assign Apache label:
semanage fcontext \
-a \
-t httpd_sys_content_t \
"/company_web(/.*)?"
Apply label:
restorecon -Rv /company_web
Verify:
ls -Z /company_web
3️⃣ Process Labels (SELinux Domain Labels)
🔹 What is Process Label?
Every running process gets an SELinux domain.
Domain decides:
What the process can access
🔍 Find Process Labels
Command:
ps -eZ
Example:
system_u:system_r:httpd_t:s0
Breakdown:
system_u
SELinux user
system_r
Process role
httpd_t
Process domain/type
s0
Security level
🔥 Important Term
Domain = Process Type
Examples:
httpd_t
Apache process
sshd_t
SSH daemon
named_t
DNS server
mysqld_t
MySQL daemon
🔍 Find Apache Domain
Command:
ps -eZ | grep httpd
Example:
apache process:
system_u:system_r:httpd_t:s0
🏢 Enterprise Example
Apache Process:
httpd_t
Website Files:
httpd_sys_content_t
SELinux Rule:
httpd_t
can read
httpd_sys_content_t
Process Start Label
Service:
systemctl start httpd
Check:
ps -ZC httpd
4️⃣ SELinux Port Labels
📌 Purpose
SELinux controls network ports.
A service can only bind to allowed ports.
🔍 View Port Labels
Command:
semanage port -l
Example:
http_port_t
tcp
80
443
Apache Allowed Ports:
semanage port -l | grep http
🔥 Problem Example
Apache configured:
Listen 8080
Start service:
systemctl restart httpd
Error:
Permission denied
Reason:
SELinux does not allow httpd_t
to use port 8080
🛠️ Add Custom Apache Port
semanage port \
-a \
-t http_port_t \
-p tcp 8080
Verify:
semanage port -l | grep http
Result:
http_port_t
tcp
8080
════════════════════════════════════
5️⃣ SELinux User Labels
📌 Purpose
SELinux User controls:
Which roles a Linux user can use
🔍 View SELinux Users
Command:
semanage user -l
Example:
unconfined_u
staff_u
sysadm_u
Linux User Mapping
Command:
semanage login -l
Example:
root
unconfined_u
company_admin
sysadm_u
Create SELinux User
Command:
semanage user -a \
-R "staff_r sysadm_r" \
company_admin_u
Mapping Linux User:
semanage login -a \
-s company_admin_u \
bilal
Verify:
semanage login -l
════════════════════════════════════
6️⃣ SELinux Role Labels
📌 Purpose
Role defines:
What a SELinux user can become
Relationship:
SELinux User
↓
Role
↓
Type
Common Roles:
object_r
Files and objects
staff_r
Limited administrator
sysadm_r
System administrator
user_r
Normal users
🔍 View Roles
semanage user -l
Example:
sysadm_u
allowed roles:
sysadm_r
Enterprise Example:
Administrator
Linux User:
bilal
SELinux User:
sysadm_u
Role:
sysadm_r
Access:
System administration
════════════════════════════════════
7️⃣ Security Level Labels (MLS/MCS)
📌 Purpose
Provides additional security classification.
Label Format:
s0
or
s0:c0.c1023
Components:
s0
Sensitivity level
c0,c1,c2
Categories
Examples:
Confidential
s0:c1
Secret
s0:c2
🔍 View Security Context
ls -Z
🔍 View User Range
semanage login -l
Enterprise Usage:
Military
Government
Multi-tenant systems
Data classification
════════════════════════════════════
8️⃣ Complete Enterprise SELinux Troubleshooting Flow
Step 1
Check SELinux
sestatus
Step 2
Check Process Label
ps -eZ
Step 3
Check File Label
ls -Z file
Step 4
Check Port Label
semanage port -l
Step 5
Check Denials
ausearch -m AVC
Step 6
Analyze
sealert -a /var/log/audit/audit.log
Step 7
Fix Correctly
semanage fcontext
restorecon
semanage port
════════════════════════════════════
9️⃣ Enterprise SELinux Mental Model
User
↓
SELinux User Label
↓
Role Label
↓
Process Domain
↓
Access Object
File Label
Port Label
Security Level
SELinux Decision:
SUBJECT
Process Domain
wants access
OBJECT
File / Port
Policy Check
Allow or Deny
════════════════════════════════════
🔟 Most Important Enterprise Commands
Check status
sestatus
View process labels
ps -eZ
View file labels
ls -Z
View directory label
ls -Zd
Restore default labels
restorecon -Rv
Manage file contexts
semanage fcontext
Manage ports
semanage port
Manage SELinux users
semanage user
Manage login mapping
semanage login
View SELinux policy
sesearch
View AVC denials
ausearch -m AVC
🎯 Final Enterprise Concept
SELinux Protection Chain
SELinux User
↓
Role
↓
Domain (Process)
↓
Type Enforcement
↓
File / Port Label
↓
Security Level
↓
Access Decision
↓
ALLOW or DENY
SELinux Role Comparison
User2: sysadm_r
Purpose
Full system administrator
SELinux Role
sysadm_r
Typical SELinux User
sysadm_u
Security Level
s0
Domain
sysadm_t
Administration Level
High
Manage System Services
Yes
Restart Services
Yes
Manage Users
Yes
Change System Configuration
Yes
Modify SELinux Policy
Yes
Manage Firewall
Yes
Read Sensitive Files
Allowed by policy
Access /etc/shadow
Allowed through admin tools
Manage Audit Logs
Yes
Install Packages
Yes
Use sudo
Usually allowed
Enter Privileged Domains
Allowed
Risk Level
Higher
Security Impact if Compromised
High Impact
user 1
User1: staff_r
Purpose
Limited administrator / operator
SELinux Role
staff_r
Typical SELinux User
staff_u
Security Level
s0
Domain
staff_t
Administration Level
Medium
Manage System Services
Limited
Restart Services
Depends on policy
Manage Users
Limited
Change System Configuration
Limited
Modify SELinux Policy
Restricted
Manage Firewall
Restricted
Read Sensitive Files
Restricted
Access /etc/shadow
Normally Denied
Manage Audit Logs
Limited
Install Packages
Limited
Use sudo
Depends on sudoers
Enter Privileged Domains
Restricted
Risk Level
Lower
Security Impact if Compromised
Limited Damage
The reason they end with _t is because they are SELinux Types.