Table of Contents
- 1. Show SELinux status
- 2. Enable and disable SELinux with setenforce (Not recommended)
- 3. Set SELinux boolean with setsebool
- 4. Add SELinux policy with semodule
- 5. Get resolution for SELinux from setroubleshoot-server
1 Show SELinux status
The sestatus and the getenforce shows SELinux status. Enforcing means enabled and Permissive means disabled. SELinux is enabled by default.
$ sudo sestatusSELinux status: enabledSELinuxfs mount: /sys/fs/selinuxSELinux root directory: /etc/selinuxLoaded policy name: targetedCurrent mode: enforcingMode from config file: enforcingPolicy MLS status: enabledPolicy deny_unknown status: allowedMax kernel policy version: 30 $ sudo getenforceEnforcing
2 Enable and disable SELinux with setenforce (Not recommended)
Enable and disable SELinux with setenforce. “on” and “1” means enabled. “off” and “0” means disabled.
$ sudo setenforce on # Enable SELinux.$ sudo setenforce off # Disable SELinux.
But “setenforce off” is not good way. You should use setroubleshoot-server, and set boolean or add policy.
3 Set SELinux boolean with setsebool
SELinux provides boolean for controlling of some function is enabled or disabled. For example, httpd_read_user_content controls to read user home directory.
Get boolean with getsebool.
$ sudo getsebool <key> # Show key value$ sudo getsebool -a # Show all key value
Set boolean with setsebool. -P option will apply boolean permanently. “on” and “1” means enabled. “off” and “0” means disabled.
$ sudo setsebool -P <key> on # Enable <key>$ sudo setsebool -P <key> off # Disable <key>
You do not need to learn boolean name with setroubleshoot-server.
4 Add SELinux policy with semodule
If setsebool cannot allow some action, you need to add SELinux policy with semodule.
- Create “.te” file. “.te” file is text.
- Create “.mod” file from “.te” file.
- Create “.pp” file from “.mod” file. “.pp” file is binary.
- Loading “.pp” file to semodule adds SELinux policy.
$ # create my-policy.te$ checkmodule -M -m -o my-policy.mod my-policy.te$ semodule_package -m my-policy.mod -o my-policy.pp$ sudo semodule -i my-policy.pp
setroubleshoot-server will suggest “.te” file example.
5 Get resolution for SELinux from setroubleshoot-server
setroubleshoot-server provides resolution for SELinux to journald log when SELinux denies something.
5.1 setsebool example
SELinux will deny mod_userdir of httpd.
$ sudo journalctl<snip>Jun 11 22:15:59 yourhost setroubleshoot[20931]: Deleting alert4d17868b-f30d-4719-9bbd-997a38f61807, it is dontaudit’d in current policyJun 11 22:16:00 yourhost setroubleshoot[20931]: SELinux is preventinghttpd from read access on the directory public_html. For completeSELinux messages. run sealert -l 50efa2e4-2f95-40f3-ba54-114a9a44b4c2Jun 11 22:16:00 yourhost python3[20931]: SELinux is preventing httpdfrom read access on the directory public_html. ***** Plugin catchall_boolean (32.5 confidence) suggests *************** If you want to allow httpd to read user content Then you must tell SELinux about this by enablin the ‘httpd_read_user_content’ boolean. Do setsebool -P httpd_read_user_content 1<snip>
You can change SELinux control with commands at the “Do”.
$ sudo setsebool -P httpd_read_user_content 1
5.2 semodule example
SELinux will deny creating socket by Nagios.
$ sudo journalctlJun 11 23:22:42 yourhost setroubleshoot[9871]: SELinux is preventingnagios from create access on the sock_file nagios.qh. For completeSELinux messages. run sealert -l 3221abf3-4aae-4451-9d57-267a78ef12feJun 11 23:22:42 yourhost python3[9871]: SELinux is preventing nagiosfrom create access on the sock_file nagios.qh. ***** Plugin catchall (100. confidence) suggests *********************** If you believe that nagios should be allowed create access on the nagios.qh sock_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c ‘nagios’ –raw | audit2allow -M my-nagios # semodule -X 300 -i my-nagios.pp
ausearch and audit2allow creates “.pp” file and “.te” file. But ausearch does not work unless SELinux denied once.
$ sudo ausearch -c ‘nagios’ –raw | audit2allow -M my-nagios******************** IMPORTANT ***********************To make this policy package active, execute:semodule -i my-nagios.pp$ ls my-nagios.*my-nagios.pp my-nagios.te
semodule adds SELinux policy.
$ sudo semodule -X 300 -i my-nagios.pp
For adding SELinux policy before SELinux denies, you need to create “.te” file manually.
- Create “.te” file and “.pp” file with ausearch and audit2allow after SELinux denied on test environment. And copy “.te” file to product environment.
- Add SELinux policy with “.te” file on product environment before SELinux denies.
$ cat my-nagios.temodule my-nagios 1.0;require { type nagios_log_t; type nagios_t; class sock_file create;}#============= nagios_t ==============allow nagios_t nagios_log_t:sock_file create;
