Contents
How to write custom SELinux policy Red Hat Enterprise Linux 8?
The default SELinux policy provided by the selinux-policy packages contains rules for applications and daemons that are parts of Red Hat Enterprise Linux 8 and are provided by packages in its repositories. Applications not described in a rule in this distribution policy are not confined by SELinux.
Where are the policy files stored in SELinux?
Unlike with Linux kernel modules, which can be automatically loaded (if needed) when they are located in the right directory, SELinux requires policy modules to be explicitly loaded (by the administrator or through its configuration). On most systems, the policy files are stored in /usr/share/selinux/strict.
How does the kernel enforce the SELinux policy?
The kernel enforces the use of an SELinux policy to evaluate access requests on the system. By default, SELinux denies all requests except for requests that correspond to the rules specified in the loaded policy.
How to get a list of SELinux modules?
The list of SELinux modules that are currently loaded on a system can be obtained with semodule -l . alsa 1.11.4 apache 2.6.10 apm 1.11.4 application 1.2.0 On some distributions, you can even get information about each module through automatically generated man pages, like with man selinux_apache.
How to Postfix Red Hat Enterprise Linux 7?
SELinux Contexts for Processes 2.3. SELinux Contexts for Users 3. Targeted Policy 3.1. Confined Processes 3.2. Unconfined Processes 3.3. Confined and Unconfined Users 3.3.1. The sudo Transition and SELinux Roles 4. Working with SELinux 4.1. SELinux Packages 4.2. Which Log File is Used 4.3. Main Configuration File 4.4.
How does a security policy work in SELinux?
An SELinux security policy is a collection of SELinux rules. A policy is a core component of SELinux and is loaded into the kernel by SELinux user-space tools. The kernel enforces the use of an SELinux policy to evaluate access requests on the system.
Why is SELinux enabled in CentOS / RHEL 7?
Security Enhanced Linux (SELinux) is enabled and running in enforcing mode by default in CentOS/RHEL based Linux operating systems, and with good reason as it increases overall system security. Despite this there may be times when you want to temporarily or permanently disable SELinux, which is what we’ll cover here.
How to create your own policy module in SELinux?
When developing or updating SELinux policies, it is recommended to use the modular approach. In this situation, you can create your own policy module (say localpolicy.pp and deal with it as if it was part of the global set of policies.
How are labels stored in a SELinux policy?
An SELinux security policy assigns labels to processes and defines relations to system resources. This way, a policy maps operating-system entities to the SELinux layer. SELinux labels are stored as extended attributes of file systems, such as ext2.