SELinux modes and security contexts

The idea

Ordinary Linux permissions answer: does this user have read, write or execute on this file? That is discretionary access control: the owner decides, and any process running as root can do anything. SELinux adds mandatory access control on top. The system policy decides which process type may touch which object type, whatever the user ID, and even root is confined.

An example: the web server httpd is allowed to read files labelled httpd_sys_content_t. If it is exploited and tries to read /etc/shadow (labelled shadow_t) or your home directory (user_home_t), SELinux refuses, although httpd could read them by ordinary permissions. Both checks must pass: first the normal mode bits, then SELinux.

Modes

Mode	Behaviour
Enforcing	Policy is applied: violations are blocked and logged. The right setting for production and the exam
Permissive	Violations are only logged. For diagnosis (“is SELinux the cause?”)
Disabled	No SELinux at all. Avoid

Task	Command
Current mode	getenforce, sestatus
Change now (lost at reboot)	setenforce 0 (permissive), setenforce 1 (enforcing)
Change for every boot	SELINUX=enforcing or permissive in /etc/selinux/config

The two are independent: setenforce does not edit the file and the file does not change the running system until reboot. A task phrased “must remain after reboot” needs the file. The targeted policy confines selected network-facing services; all else runs unconfined.

Contexts

Every file, process, port and user has a context: four colon-separated fields.

system_u : object_r : httpd_sys_content_t : s0
 user      role        type                 level

For the targeted policy everything that matters is the type: a process type (httpd_t) is allowed or denied access to object types (httpd_sys_content_t). The user and role fields are mostly fixed, and the level (s0) is for MLS/MCS and is usually ignored.

What	Command
Files and directories	ls -Z, ls -Zd DIR
Processes	ps -eZ, ps -Z PID
Your user	id -Z
What the policy says a path should be	matchpathcon PATH

A new file takes the context of its parent directory. A file that is moved (mv) keeps its old label; a copied file (cp) takes the label of its new location. That difference explains most “I moved it to the web root and now it’s forbidden” problems.

Try it

getenforce
sestatus

Enforcing
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

Switch it for now, then for good

sudo setenforce 0
getenforce
sudo setenforce 1

Permissive

sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
grep -E '^SELINUX=' /etc/selinux/config

SELINUX=permissive

Restore it the same way (enforcing) before finishing.

Read contexts

ls -Zd /etc/passwd /var/www/html /home
ps -Z $$
id -Z

system_u:object_r:passwd_file_t:s0 /etc/passwd
system_u:object_r:httpd_sys_content_t:s0 /var/www/html
system_u:object_r:home_root_t:s0 /home
LABEL                                    PID TTY      STAT   TIME COMMAND
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4120 pts/0 Ss 0:00 -bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Your interactive shell is unconfined_t: not restricted by the targeted policy. Services such as httpd_t and sshd_t are.

What should it be?

echo hi | sudo tee /tmp/page.html /var/www/html/page.html
ls -Z /tmp/page.html /var/www/html/page.html
matchpathcon /var/www/html/page.html

unconfined_u:object_r:user_tmp_t:s0 /tmp/page.html
unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/page.html
/var/www/html/page.html	system_u:object_r:httpd_sys_content_t:s0

The file created in /var/www/html inherited httpd_sys_content_t from the directory. The one in /tmp did not, and if you mv it into the web root it would keep user_tmp_t, which httpd may not read.

Going further

sestatus -v shows the labels of important files and processes. seinfo and sesearch -A -s httpd_t -t httpd_sys_content_t (package setools-console) query the policy itself: they show exactly what httpd_t is allowed to do with that type. getenforce inside a container reports the host’s mode. ls -Z and ps -Z are the first thing to run in every SELinux investigation, because most denials are wrong labels. Other policies (minimum, mls) exist, but targeted is the RHEL default.