1. Demystifying SELinux: WTF is it saying?
Dave Quigley
SELinux Ninja/Linux Kernel Developer

2. Access Controls determine who/what can access system resources
What is Access Control?
Access Controls determine who/what can access system resources

3. What You're Use To Web Content Home Directory Files Sensitive
Credit Card
Data
Dave
(Apache)
Dave
(Firefox)

4. A “New” Type of Access Controls
Web Content
TCP
Port 80
Sensitive
Credit Card
Data
Database
Socket
Apache
Logs
Dave
(Apache)
Dave
(PostgreSQL)
Database
Files

5. What is SELinux? SELinux is a label based security system
Every process has a label, every object on the system has a label
Files, Directories, network ports …
The SELinux policy controls how process labels interact with other labels on the system
The kernel enforces the policy rules

6. All information needed for SELinux to make an access control decision
What is a Label?
-rw-r--r-- root root system_u:object_r:etc_t:s /etc/passwd
DAC Components
Security Label
system_u:object_r:etc_t:s0
User
Role
Type
MLS
All information needed for SELinux to make an access control decision

7. How do I see Labels? Files Processes Ports ls -Z ps -Z, pstree -Z
netstat -Z, semanage ports -l

8. How to tell if something is wrong?
Logged to /var/log/messages if no auditd or during early boot before auditd.
grep avc /var/log/messages
Logged to /var/log/audit/audit.log if running auditd.
/sbin/ausearch -mAVC,SELINUX_ERR -i
Notification via setroubleshoot if running.
/var/log/audit/audit.log, desktop pop-up

9. Most Common SELinux Problems
Incorrect Labeling
Non-Default Config of a Confined Program
Bug in Policy or an Application
Your machine may have been compromised

10. Labeling Problems Every process and object on the system is labeled
If labels are not correct access may be denied
Causes
Alternative paths (semanage fcontext)
Files created in wrong context (restorecon)
Processes started in wrong context

11. Usecase: Move instead of copy
Administrator uploads and extracts a tarball of static web content to his home directory
Administrator moves the files into the document root for
Administrator tries to access site
Access fails, why?

12. Non-Default Configuration
SELinux needs to know how a confined daemon is configured
Non-default directories
Need to ensure files are labeled properly
Booleans
Allow optional functionality to be enabled
Non-default ports
Need to ensure ports labeled properly

13. Usecase: Non Default Location
Administrator decides to setup a website with the location of /opt/www
Administrator creates the directory and copies files into it.
Administrator tries to access site
Page access fails, why?

14. Usecase: Web content in user home directories
Administrator decides to setup a website to allow users to host personal webpages.
Administrator enables Userdirs to public_html.
Administrator tries to access site userhome.com/~sedemo
Page access fails, why?

15. Usecase: Apache on a non-standard port
Administrator decides to change the port his apache server at to to heighten security.
Administrator changes the listening port in the config.
Administrator tries start httpd.
Server fails to start, why?

16. Bugs in Policy/Apps SELinux policy bugs
Incomplete policy (unusual code path)
Unknown application configuration
Application bugs
Leaked File Descriptors
Executable Memory (execmem)
Badly built libraries (execmem and others)

17. Bugs in Policy/Apps (2) Options
Report bugs in bugzilla (Best long term solution)
Create a policy module (Temporary fix)
Labeling is correct? No appropriate booleans?
Use audit2allow to create a policy module
Examine resulting policy
Make sure it's safe
Ask for help (#fedora-selinux and mailing lists)

18. Your machine may have been compromised
Current tools not good at differentiating
Warning signs: a confined domain tries to:
Load a kernel module
Turn off SELinux enforcing mode
Write to etc_t or shadow_t
Modify iptables rules
Sendmail
others
You may be compromised

19. Resources Google+ SELinux SELinux Community Websitesg
Mailing Lists
Fedora SELinux
NSA SELinux
IRC
#selinux on FreeNode
Presentation files
uigl/demystifying- selinux

20. Questions?

21. Survey
Thank you for listening to me talk. Please help improve the talk by filling out a quick survey at