49.6.4. Enabling MLS in SELinux

Note

It is not recommended to use the MLS policy on a system that is running the X Window System.

Follow these steps to enable the SELinux MLS policy on your system.

Install the selinux-policy-mls package:
```
yum install selinux-policy-mls
```
```
~]# yum install selinux-policy-mls
```
Copy to Clipboard Toggle word wrap

Before the MLS policy is enabled, each file on the file system must be relabeled with an MLS label. When the file system is relabeled, confined domains may be denied access, which may prevent your system from booting correctly. To prevent this from happening, configure SELINUX=permissive in the /etc/selinux/config file. Also, enable the MLS policy by configuring SELINUXTYPE=mls. Your configuration file should look like this:

This file controls the state of SELinux on the system.
SELINUX= can take one of these three values:
    enforcing - SELinux security policy is enforced.
    permissive - SELinux prints warnings instead of enforcing.
    disabled - No SELinux policy is loaded.
SELINUXTYPE= can take one of these two values:
    targeted - Targeted processes are protected,
    minimum - Modification of targeted policy. Only selected processes are protected.
    mls - Multi Level Security protection.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=mls

Copy to Clipboard

Toggle word wrap

Make sure SELinux is running in the permissive mode:
```
setenforce 0
getenforce
```
```
~]# setenforce 0
~]# getenforce
Permissive
```
Copy to Clipboard Toggle word wrap
Create the .autorelabel file in root's home directory to ensure that files are relabeled upon next reboot:
```
touch /.autorelabel
```
```
~]# touch /.autorelabel
```
Copy to Clipboard Toggle word wrap
Reboot your system. During the next boot, all file systems will be relabeled according to the MLS policy. The label process labels all files with an appropriate SELinux context:
```
*** Warning -- SELinux mls policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
***********
```
```
*** Warning -- SELinux mls policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
***********
```
Copy to Clipboard Toggle word wrap
Each * (asterisk) character on the bottom line represents 1000 files that have been labeled. In the above example, eleven * characters represent 11000 files which have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes. Once the labeling process finishes, the system will automatically reboot.
Once the file system is relabeled, execute the following commands to assure that the /root directory and all other home directories are properly labeled:
```
genhomedircon
restorecon -R -v /root /home <other_home_directories>
```
```
~]# genhomedircon
~]# restorecon -R -v /root /home <other_home_directories>restorecon -R -v /root /home <other_home_directories>
```
Copy to Clipboard Toggle word wrap
In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as the Linux root user, run the grep "SELinux is preventing" /var/log/messages command to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output.

If there were no denial messages in /var/log/messages, or you have resolved all existing denials, configure SELINUX=enforcing in the /etc/selinux/config file:

This file controls the state of SELinux on the system.
SELINUX= can take one of these three values:
    enforcing - SELinux security policy is enforced.
    permissive - SELinux prints warnings instead of enforcing.
    disabled - No SELinux policy is loaded.
SELINUXTYPE= can take one of these two values:
    targeted - Targeted processes are protected,
    minimum - Modification of targeted policy. Only selected processes are protected.
    mls - Multi Level Security protection.

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=mls

Copy to Clipboard

Toggle word wrap

Reboot your system and make sure SELinux is running in permissive mode:
```
getenforce
```
```
~]$ getenforce
Enforcing
```
Copy to Clipboard Toggle word wrap
and the MLS policy is enabled:
```
sestatus |grep mls
```
```
~]# sestatus |grep mls
Policy from config file:        mls
```
Copy to Clipboard Toggle word wrap

Nach oben

49.6.4. Enabling MLS in SELinux

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Mehr Inklusion in Open Source

Über Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links