Introduction to the Red Hat SELinux Guide

Welcome to the Red Hat SELinux Guide. This guide addresses the complex world of SELinux policy,

and has the goal of teaching you how to understand, use, administer, and troubleshoot SELinux in

a Red Hat Enterprise Linux environment. SELinux, an implementation of mandatory access control

(MAC) in the Linux kernel, adds the ability to administratively define policies on all subjects (pro 

cesses) and objects (devices, files, and signaled processes). These terms are used as an abstract when

discussing actors/doers and their targets on a system. This guide commonly refers to processes, the

source of an operations, and objects, the target of an operation.

This guide opens with a short explanation of SELinux, some assumptions about the reader, and an

explanation of document conventions. The first part of the guide provides an overview of the technical

architecture and how policy works, specifically the policy that comes with Red Hat Enterprise Linux

called the targeted policy. The second part focuses on working with SELinux, including maintaining

and manipulating your systems, policy analysis, and compiling your custom policy. Working with

some of the daemons that are confined by the targeted policy is discussed throughout. These daemons

are collectively called the targeted daemons.

One powerful way of finding information in this guide is the Index. The Index has direct links to

sections on specific terminology, and also features lists of various SELinux syntaxes, as well as what

are/what is and how to entries.

1. What Is SELinux?

This section is a very brief overview of SELinux. More detail is given in Part I Understanding SELinux

and Appendix A Brief Background and History of SELinux.

Security enhanced Linux (SELinux) is an implementation of a mandatory access control mechanism.

This mechanism is in the Linux kernel, checking for allowed operations after standard Linux discre 

tionary access controls are checked.

To understand the benefit of mandatory access control (MAC) over traditional discretionary access

control (DAC), you need to first understand the limitations of DAC.

Under DAC, ownership of a file object provides potentially crippling or risky control over the object.

A user can expose a file or directory to a security or confidentiality breach with a misconfigured

chmod

command and an unexpected propagation of access rights. A process started by that user, such as a

CGI script, can do anything it wants to the files owned by the user. A compromised Apache HTTP

server can perform any operation on files in the Web group. Malicious or broken software can have

root level access to the entire system, either by running as a root process or using

setuid

or

setgid

.

Under DAC, there are really only two major categories of users, administrators and

non administrators. In order for services and programs to run with any level of elevated privilege, the

choices are few and course grained, and typically resolve to just giving full administrator access.

Solutions such as ACLs (access control lists) can provide some additional security for allowing

non administrators expanded privileges, but for the most part a root account has complete discretion

over the file system.

A MAC or non discretionary access control framework allows you to define permissions for how all

processes (called subjects) interact with other parts of the system such as files, devices, sockets, ports,

and other processes (called objects in SELinux). This is done through an administratively defined

security policy over all processes and objects. These processes and objects are controlled through the

kernel, and security decisions are made on all available information rather than just user identity. With

this model, a process can be granted just the permissions it needs to be functional. This follows the

principle of least privilege. Under MAC, for example, users who have exposed their data using

chmod

are protected by the fact that their data is a kind only associated with user home directories, and

confined processes cannot touch those files without permission and purpose written into the policy.