An Introduction to SELinux Presentation Toshaan Bharvani - VanTosh - PowerPoint PPT Presentation

An Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it SELinux states Managing SELinux FroSCon 2012 Policies 25 August 2012 The End An Introduction to SELinux Presentation Toshaan Bharvani - VanTosh bvba < toshaan@vantosh.com > An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 1 / 29

An $ whoami Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction Toshaan Bharvani How to use it From Antwerp, Belgium SELinux states Currently self-employed : VanTosh Managing SELinux Involved with Enterprise Linux, RPM packaging Policies The End Like to keep everything secure Involved with hardware, software and conferences Twitter : @toshywoshy / Identi.ca : @toshywoshy An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 2 / 29

An Table of contents Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it Introduction 1 SELinux states Managing SELinux Policies How to use it 2 The End SELinux states Managing SELinux Policies An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 3 / 29

An Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it 1 SELinux states Managing SELinux Introduction Policies The End An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 4 / 29

An Traditional Linux Permissions Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it everything is a file SELinux states 3 x 3 file level security Managing SELinux user, group, others Policies read, write, execute The End 0/-, 4/r, 2/w, 1/x 1 1 If you didn’t notice this is binary. An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 5 / 29

An What is SELinux Introduction to SELinux Toshaan Bharvani - VanTosh bvba SELinux = Security-Enhanced Linux Introduction Mechanism for supporting Mandatory Access Control How to use it security policies SELinux states Linux Security Modules (LSM) run in the Linux kernel Managing SELinux Everything is a context Policies The End Several security models Type Enforcement (TE) Role Based Access Control (RBAC) Multilevel Security (MLS) Developed by the NSA An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 6 / 29

An Access Control Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction Type Enforcement (TE) How to use it The primary mechanism of access control used in the SELinux states targeted policy Managing SELinux Role-Based Access Control (RBAC) Policies Based around SELinux users (not necessarily the same as The End the Linux user) Multi-Level Security (MLS) Not used and often hidden in the default targeted policy. An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 7 / 29

An SELinux visually Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it SELinux states Managing SELinux Policies The End An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 8 / 29

An SELinux features Introduction to SELinux Separation of policy from enforcement Toshaan Bharvani - VanTosh Predefined policy interfaces bvba Support for applications querying the policy and enforcing Introduction access control How to use it Independent of specific policies, policy languages, security SELinux states label formats and contents Managing SELinux Caching of access decisions for efficiency Policies Policy changes are possible (!!!) The End Separate measures for protecting system integrity and data confidentiality Controls over process initialization and inheritance and program execution Controls file systems, directories, files, and open file descriptors Controls over sockets, messages, and network interfaces An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 9 / 29

An SELinux hidden features (from hell) Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction Breaks systems that are not secure How to use it Disallows services of misbehaving SELinux states Annoyment tool for juniors Managing SELinux Will take over the world Policies The End Restricts the root user Cannot be disabled just like that for daemons Inappropriate processes will be excommunicated An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 10 / 29

An Past, Today, Future Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it SELinux states Managing SELinux Policies The End An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 11 / 29

An Where is SELinux Introduction to SELinux Toshaan Bharvani - VanTosh bvba In the kernel from 2.6.0 - 2002 Introduction Redhat Enterprise Linux : from v4 How to use it SELinux CentOS : from v4 states Managing Fedora : from Core 2 SELinux Policies Novel SLES, OpenSuSE The End Gentoo Debian (Etch), Ubuntu (8.04) AndroidSE . . . An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 12 / 29

An Misconceptions about SELinux Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction “Life is too short for SELinux” 2 – Theodore Ts’o How to use it SELinux “SELinux is a pain in the ass” – urban legend states Managing Upstream vendors requires me to disable SELinux SELinux Policies The End 2 SELinux is so horrible to use that, after wasting a large amount of time enabling it and then watching all of my applications die a horrible death since they didn’t have the appropriate hand-crafted security policy, caused me to swear off of it. For me, given my threat model and how much my time is worth, life is too short for SELinux. An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 13 / 29

An The good of SELinux Introduction to SELinux Toshaan Bharvani - VanTosh bvba “Let me assure you that this action by the NSA was the Introduction crypto-equivalent of the Pope coming down off the balcony How to use it SELinux in Rome, working the crowd with a few loaves of bread and states some fish, and then inviting everyone to come over to his Managing SELinux place to watch the soccer game and have a few beers. Policies There are some things that one just never expects to see, The End and the NSA handing out source code along with details of the security mechanism behind it was right up there on that list.” – Larry Loeb 3 3 Security author and researcher An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 14 / 29

An Why use SELinux? Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction It confines processes,services,users in compartments How to use it Allows use of one compartment of a systems : SELinux states virtual machine : sVirt (qemu, lxc, . . . ) Managing user : xguest SELinux hardware : usbredir, automobile, smartphone, . . . Policies The End Stops daemons going bad Really increases security No, it isn’t difficult An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 15 / 29

An Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it 2 SELinux states Managing SELinux How to use it Policies The End An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 16 / 29

An Changing SELinux states Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction Enforcing How to use it Enable and enforce the SELinux security policy on the SELinux states system, denying access and logging actions Managing SELinux Permissive Policies Enables, but will not enforce the security policy, only warn The End and log actions Disabled SELinux is turned off An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 17 / 29

An Checking the state of SELinux Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction sestatus How to use it SELinux Enforcing states Permissive Managing SELinux - Z Policies ls -Z The End netstat -Z ps -Z An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 18 / 29

An File labels Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it Objects (Processes, files, inodes, superblocks etc.) in the SELinux states OS are labeled Managing SELinux Files persistently labeled via extended attributes Policies Labels are called security contexts The End Labels contain all SELinux security information An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 19 / 29

An Relabelling files Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction chcon -R -t httpd sys content t /usr/srv/www How to use it semanage fcontext -a -t httpd sys content t SELinux states ”/usr/srv/www(/.*)?” Managing SELinux restorecon -Rv -n /var/www/html Policies Relabelling whole the filesystem The End genhomedircon touch /.autorelabel reboot An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 20 / 29

An Enabling bools & ports Introduction to SELinux Toshaan Bharvani - VanTosh bvba Introduction How to use it Managing ports SELinux states semanage port -l Managing semanage port -a -t http port t -p tcp 8181 SELinux Policies Managing predefined policies The End getsebool -a | grep samba setsebool -P samba enable home dirs on An Introduction to SELinux Toshaan Bharvani - VanTosh bvba 21 / 29