SELinux Cookbook

Reading the context of a resource

Running new processes in a new context

Interrogating the SELinux subsystem code-wise

Querying SELinux userland configuration in C

Checking the SELinux state programmatically

Using cron with SELinux

Understanding udev's SELinux integration

Restricting service ownership

Controlling D-Bus message flows

Introduction

Chapter 10. Handling SELinux-aware Applications

Governing application network access

Backing up and restoring files

Using group membership for role-based access

Configuring capabilities instead of setuid binaries

Enabling polyinstantiated directories

Sharing user content with file ACLs

Using a different root location for SELinux-aware applications

Assigning a different root location to regular services

Introduction

Chapter 9. Aligning SELinux with DAC

Auditing system behavior

Using strace against daemons

Using strace to clarify permission issues

Ensuring an SELinux rule is never allowed

Looking through SELinux constraints

Logging positive policy decisions

Analyzing SELINUX_ERR messages

Identifying whether SELinux is to blame

Introduction

Chapter 8. Debugging SELinux

Using fine-grained application domain definitions

Building application-specific domains using templates

Creating a generic application domain

Granting privileges to all clients

Documenting common privileges

Defining common helper domains

Finding common resources

Introduction

Chapter 7. Choosing the Confinement Level

Looking into access privileges

Defining role transitions

Initial role based on entry

Creating a new role

Switching roles

Running commands in a specified role with runcon

Running commands in a specified role with sudo

Mapping Linux users to SELinux users

Managing SELinux users

Introduction

Chapter 6. Setting Up Separate Roles

Creating the administrative interface

Creating a stream-connect interface

Creating exec run and transition interfaces

Creating resource-access interfaces

Differentiating policies based on use cases

Choosing resource types wisely

Understanding the service

Introduction

Chapter 5. Creating a Server Policy

Adding build-time policy decisions

Adding conditional policy rules

Creating application resource interfaces

Ignoring permissions we don't need

Testing and enhancing the policy

Defining application role interfaces

Setting context definitions

Creating a skeleton policy

Researching the application's logical design

Introduction

Chapter 4. Creating a Desktop Application Policy

Separating virtual hosts with mod_selinux

Using source address mapping to decide on contexts

Mapping HTTP users to contexts

Starting Apache with limited clearance

Creating a custom CGI domain

Setting up mod_selinux

Using custom content types

Using different web server ports

Assigning web content types

Enabling user directory support

Listing conditional policy support

Introduction

Chapter 3. Confining Web Applications

Configuring sensitivity categories

Setting resource-sensitivity labels

Enhancing an SELinux policy with file transitions

Using substitution definitions

Defining file contexts through patterns

Introduction

Chapter 2. Dealing with File Labels

Distributing SELinux policy modules

Using the refpolicy naming convention

Creating our own interface

Calling refpolicy interfaces

Building a simple SELinux module

Creating the development environment

Introduction

Chapter 1. The SELinux Development Environment

Customer support

Reader feedback

Conventions

Who this book is for

What you need for this book

What this book covers

Preface

Support files eBooks discount offers and more

www.PacktPub.com

About the Reviewers

About the Author

Credits

版权页

封面

封面

版权页

Credits

About the Author

About the Reviewers

www.PacktPub.com

Support files eBooks discount offers and more

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Chapter 1. The SELinux Development Environment

Introduction

Creating the development environment

Building a simple SELinux module

Calling refpolicy interfaces

Creating our own interface

Using the refpolicy naming convention

Distributing SELinux policy modules

Chapter 2. Dealing with File Labels

Introduction

Defining file contexts through patterns

Using substitution definitions

Enhancing an SELinux policy with file transitions

Setting resource-sensitivity labels

Configuring sensitivity categories

Chapter 3. Confining Web Applications

Introduction

Listing conditional policy support

Enabling user directory support

Assigning web content types

Using different web server ports

Using custom content types

Setting up mod_selinux

Creating a custom CGI domain

Starting Apache with limited clearance

Mapping HTTP users to contexts

Using source address mapping to decide on contexts

Separating virtual hosts with mod_selinux

Chapter 4. Creating a Desktop Application Policy

Introduction

Researching the application's logical design

Creating a skeleton policy

Setting context definitions

Defining application role interfaces

Testing and enhancing the policy

Ignoring permissions we don't need

Creating application resource interfaces

Adding conditional policy rules

Adding build-time policy decisions

Chapter 5. Creating a Server Policy

Introduction

Understanding the service

Choosing resource types wisely

Differentiating policies based on use cases

Creating resource-access interfaces

Creating exec run and transition interfaces

Creating a stream-connect interface

Creating the administrative interface

Chapter 6. Setting Up Separate Roles

Introduction

Managing SELinux users

Mapping Linux users to SELinux users

Running commands in a specified role with sudo

Running commands in a specified role with runcon

Switching roles

Creating a new role

Initial role based on entry

Defining role transitions

Looking into access privileges

Chapter 7. Choosing the Confinement Level

Introduction

Finding common resources

Defining common helper domains

Documenting common privileges

Granting privileges to all clients

Creating a generic application domain

Building application-specific domains using templates

Using fine-grained application domain definitions

Chapter 8. Debugging SELinux

Introduction

Identifying whether SELinux is to blame

Analyzing SELINUX_ERR messages

Logging positive policy decisions

Looking through SELinux constraints

Ensuring an SELinux rule is never allowed

Using strace to clarify permission issues

Using strace against daemons

Auditing system behavior

Chapter 9. Aligning SELinux with DAC

Introduction

Assigning a different root location to regular services

Using a different root location for SELinux-aware applications

Sharing user content with file ACLs

Enabling polyinstantiated directories

Configuring capabilities instead of setuid binaries

Using group membership for role-based access

Backing up and restoring files

Governing application network access

Chapter 10. Handling SELinux-aware Applications

Introduction

Controlling D-Bus message flows

Restricting service ownership

Understanding udev's SELinux integration

Using cron with SELinux

Checking the SELinux state programmatically

Querying SELinux userland configuration in C

Interrogating the SELinux subsystem code-wise

Running new processes in a new context

Reading the context of a resource