Chapter 4. Targeted Policy

Procedure 4.1. How to Verify SELinux Status

1. Run the sestatus command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used. The correct output should look similar to the output bellow.

   ~]$ sestatus
   SELinux status:                 enabled
   SELinuxfs mount:                /selinux
   Current mode:                   enforcing
   Mode from config file:          enforcing
   Policy version:                 24
   Policy from config file:        targeted
   

   Copy to Clipboard Toggle word wrap
   Refer to the section Section 5.4, “Permanent Changes in SELinux States and Modes” for detailed information about enabling and disabling SELinux.
2. As the Linux root user, run the touch /var/www/html/testfile command to create a file.
3. Run the ls -Z /var/www/html/testfile command to view the SELinux context:

   -rw-r--r--  root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/testfile
   

   Copy to Clipboard Toggle word wrap
   By default, Linux users run unconfined in Red Hat Enterprise Linux, which is why the testfile file is labeled with the SELinux unconfined_u user. RBAC is used for processes, not files. Roles do not have a meaning for files; the object_r role is a generic role used for files (on persistent storage and network file systems). Under the /proc/ directory, files related to processes may use the system_r role. The httpd_sys_content_t type allows the httpd process to access this file.

Procedure 4.2. An Example of Confined Process

1. As the Linux root user, run the service httpd start command to start the httpd process. The output is as follows if httpd starts successfully:

   ~]# service httpd start
   Starting httpd:                                            [  OK  ]
   

   Copy to Clipboard Toggle word wrap
2. Change into a directory where your Linux user has write access to, and run the wget http://localhost/testfile command. Unless there are changes to the default configuration, this command succeeds:

   ~]$ wget http://localhost/testfile
   --2009-11-06 17:43:01--  http://localhost/testfile
   Resolving localhost... 127.0.0.1
   Connecting to localhost|127.0.0.1|:80... connected.
   HTTP request sent, awaiting response... 200 OK
   Length: 0 [text/plain]
   Saving to: `testfile'
   
   [ <=>                              ] 0     --.-K/s   in 0s
   		
   2009-11-06 17:43:01 (0.00 B/s) - `testfile' saved [0/0]
   

   Copy to Clipboard Toggle word wrap
3. The chcon command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the semanage command, which is discussed later. As the Linux root user, run the following command to change the type to a type used by Samba:

   ~]# chcon -t samba_share_t /var/www/html/testfile

   Copy to Clipboard Toggle word wrap
   Run the ls -Z /var/www/html/testfile command to view the changes:

   -rw-r--r--  root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile
   

   Copy to Clipboard Toggle word wrap
4. Note: the current DAC permissions allow the httpd process access to testfile. Change into a directory where your Linux user has write access to, and run the wget http://localhost/testfile command. Unless there are changes to the default configuration, this command fails:

   ~]$ wget http://localhost/testfile
   --2009-11-06 14:11:23--  http://localhost/testfile
   Resolving localhost... 127.0.0.1
   Connecting to localhost|127.0.0.1|:80... connected.
   HTTP request sent, awaiting response... 403 Forbidden
   2009-11-06 14:11:23 ERROR 403: Forbidden.
   

   Copy to Clipboard Toggle word wrap
5. As the Linux root user, run the rm -i /var/www/html/testfile command to remove testfile.
6. If you do not require httpd to be running, as the Linux root user, run the service httpd stop command to stop httpd:

   ~]# service httpd stop
   Stopping httpd:                                            [  OK  ]
   

   Copy to Clipboard Toggle word wrap