Contents
What does a policy file in SELinux do?
SELinux governs processes with policies. Usually, a policy is made up of a labeling file, a rule file, and an interface file. These are compiled to produce a policy file, which is then loaded into the Linux kernel. You can load or unload SELinux policies without rebooting.
Where are the security contexts stored in SELinux?
SELinux assigns a label, called security context, to every object (file, process, etc) in the system: Files have security context stored in extended attributes. These can be viewed with ls -Z. SELinux maintains a database mapping paths patterns to default file contexts.
Can a user of an object be changed in SELinux?
The only current rule says that except for privileged domains, the user of an object can’t be changed (see the “constraints” file in the policy source tree). The term “object” in SELinux stands for files, directories, file descriptors, pipes, sockets, network interfaces and many more.
How to create a WordPress policy in SELinux?
Create a policy to assign the httpd_sys_rw_content_t context to the WordPress configuration file, wp-config.php. Our policies are created and ready to be applied to our directory structure. We will use the restorecon command to apply them.
How does SELinux allow services to use non standard ports?
This increases system security by preventing random services or malicious code from being able to bind to a well known defined port that may otherwise be used by a legitimate service. In order to change a service to use a non standard port we must change SELinux policy and specify the SELinux port types that are allowed to use specific ports.
How are labels stored in a SELinux system?
In SELinux, every process, file, directory, and system object has a label. Policy rules control access between labeled processes and labeled objects. These labels are stored as extended attributes on the file system. For objects that aren’t files, such as processes and ports, the kernel manages the labels.
What does a sysadmin do in a SELinux server?
A sysadmin determines whether a given process can access files, pipes, ports, and so on. There is no access by default, even if you’re the root user. SELinux defines what can be done with each object according to a set policy. For instance, by default, the Apache user can access only the /var/www/html directory.