Getting started with SELinux System Administration

Disabling SELinux is a commonly requested activity. Some vendors do not support their application running on a platform that has SELinux enabled. You will learn through this video how to enable or disable SELinux.

A security-oriented subsystem such as SELinux can only succeed if it is capable of enhanced logging and even debugging. Let’s have a look at this aspect of SELinux.

Although most SELinux log events are AVC related, they aren't the sole event types an administrator will have to deal with. Few event types are directly concerned with SELinux. Let’s have a look at these.

On some distributions, additional support tools are available that help us identify the cause of a denial. These tools have some knowledge of the common mistakes. This video will let you get help from denials.

Once logged in to a system, our user will run inside a certain context. This user context defines the rights and privileges that we, as a user, have on the system. Let’s have a look at how we could set the SELinux contexts.

Within SELinux systems, the moment a user logs in, the login system checks which SELinux user his or her login is mapped to. Hence, it’s crucial to map the user correctly with the exact role. Let’s dive into SELinux users and roles.

We saw how SELinux users define the role(s) that a user can be in. But how does SELinux enforce which role a user logs on through? And when logged on, how can a user switch his active role? Let’s answer to this question with this video.

With all the information about SELinux users and roles, we have not touched upon how exactly applications are able to create and assign a SELinux context to a user. Let’s explore this, through this video.

This video will show you how to use a web-based application deployment as an example: DokuWiki, which is a popular PHP wiki that uses files rather than a database as its backend system and is easy to install and manage.

Now that you are aware that file contexts are stored as extended attributes, how do we ensure that files receive the correct label when they are written or modified? This video will answer this question.

When we think that the context of a file is wrong, we need to correct the context. SELinux offers several methods to do so, and some distributions even add in more. Let’s have a look at these methods.

This video will show you the different approaches which are available for you in SELinux to modify file contexts

As everything in SELinux works with labels, even processes are assigned a label, also known as the domain. Let’s explore the context of a process through this video.

For security reasons, Linux systems can reduce the ability for processes to gain elevated privileges under certain situations or provide additional constraints to reduce the likelihood of vulnerabilities to be exploitable. Let’s see how we could limit the scope of transitions in SELinux.

Now that you know more about types, let's look into how these are used in the SELinux policy in more detail.

Linux applications communicate with each other either directly or over a network. Let's look at the various communication methods that Linux supports and how SELinux aligns with them.

The approach with TCP and UDP ports has a few downsides. One of them is that there is no knowledge of the target host, so you cannot govern where an application can connect to. Let’s see how we could tackle this situation with Linux netfilter and SECMARCK support.

Another approach to further fine-tune the access controls on the network level is to introduce labeled networking. This video will show you how you could implement this approach.

This video will show you, how you could use NetLabel/CIPSO support, to label traffic with sensitivity information and use it across the network.