danwalsh


Dan Walsh's Blog

Got SELinux?


Previous Entry Add to Memories Share Next Entry
Key components of SELinux: Applications
danwalsh
Back to SELinux for Dummies...

Kernel


When I usually give my SELinux talk, I have a section on Key components of SELinux and I usually start out talking about the kernel. But I find that most people understand that SELinux is integrated in the upstream kernel. The kernel has many access checks built into it, and the access checks call into the Linux Security Module (LSM). But I am not a SELinux Kernel Engineer, nor do I play one on TV. So I will leave it to the Stephen Smalley's and James Morris's of the world to explain the SELinux Kernel. Besides this is SELinux for dummies, and we know that no dummies work on the kernel. :^).

Most of the papers on SELinux talk about the Kernel, and how this integration happens.

Applications:


The more interesting part in my opinion is how the rest of the Base Operating System uses SELinux. Of course that is what I work on ...

Most user applications and server applications unchanged SELinux aware applications. Of the hundreds/thousands of rpm packages in a Fedora only about 50 are compiled with SELinux awareness in them. This is one of the powerful features of SELinux in that applications do not need to be aware of SELinux.

The power of this is that it is fairly easy to write policy for a new daemon. You do not need to be a "C" programmer or fully understand the way the application works, but you can confine it with policy.

One problem with this, that you may have seen is that since an application is not aware if it is being blocked by Discretionary Access Control, or Mandatory Access Control. It just gets EPERM, Permission Denied. Administrators can become confused by this.
For example an administrator sets up a web page, the permissions on the files and ownership of the file are set correctly, yet apache reports permission denied. The file context on the files are set incorrectly, but apache has no awareness of this. We are working on tools to make this more obvious to the Administrator, but for now they need to know to look in the
/var/log/messages file or /var/log/audit/audit.log for AVC messages.

So which applications need to be SELinux aware?

  • Applications used to view or manipulate security contexts (Core Utilities)
Examples of this are the ls for viewing file context, ps for viewing process context.

  •   Programs required to set user session security context
The login programs are the most obvious programs for this login, sshd, gdm ... Also cron

  •   The SELinux core programs.
These are used to control/manipulate security context. chcon, setfiles, restorecon
Used to manipulate policy: load_policy, check_policy, check_module, semodule, semanage, setenforce, getenforce, setsebool, getsebool ...


Core Utilities

"Z" is your friend...

When I took over maintenance of the SELinux userspace I settled on to using "Z" as the universal option to show security context.

So "ps auxZ" will show you the security context of all processes. "ls -Z" will show you the security context of files. "id -Z" will show you the security context of your login shell.

So if you think an application might be SELinux aware try the -Z option...

Find command:

The find command has a powerful SELinux option "-context". This allows you to search for files matching a certain context. It uses a "glob" syntax to you can execute a command like

find /etc -context '*net_conf_t'
/etc/sysconfig/networking/profiles/default/resolv.conf
/etc/resolv.conf.windham
/etc/resolv.conf.comcast
/etc/ntp.conf
/etc/ntp/step-tickers
/etc/resolv.conf.old
/etc/yp.conf
/etc/resolv.conf.redhat
/etc/resolv.conf


To find all the files labeled with type net_conf_t.

Another handy find option is:

find /etc -context "*net_conf_t" -printf "%p %Z\n"
/etc/sysconfig/networking/profiles/default/resolv.conf system_u:object_r:net_conf_t
/etc/resolv.conf.windham system_u:object_r:net_conf_t
/etc/resolv.conf.comcast system_u:object_r:net_conf_t
/etc/ntp.conf system_u:object_r:net_conf_t
/etc/ntp/step-tickers system_u:object_r:net_conf_t
/etc/resolv.conf.old system_u:object_r:net_conf_t
/etc/yp.conf root:object_r:net_conf_t
/etc/resolv.conf.redhat system_u:object_r:net_conf_t
/etc/resolv.conf system_u:object_r:net_conf_t


Continued tomorrow:  mv/cp/install 



http://pagesperso.aol.fr/pahuanal/
http://pagesperso.aol.fr/peranal/
http://pagesperso.aol.fr/masranal/
http://pagesperso.aol.fr/coranall/
http://pagesperso.aol.fr/ramasiatique/
http://pagesperso.aol.fr/disasiatique/
http://pagesperso.aol.fr/posasiatique/
http://pagesperso.aol.fr/yobitee/
http://pagesperso.aol.fr/trebite/
http://pagesperso.aol.fr/webitee/
http://pagesperso.aol.fr/qevcul/
http://pagesperso.aol.fr/ejucul/
http://pagesperso.aol.fr/ttoslocul/
http://pagesperso.aol.fr/etnagay/
http://pagesperso.aol.fr/lasbegay/
http://pagesperso.aol.fr/onaggay/
http://pagesperso.aol.fr/sudogay/
http://pagesperso.aol.fr/cadagay/
http://pagesperso.aol.fr/losdegay/
http://pagesperso.aol.fr/cuangay/
http://pagesperso.aol.fr/moligayy/
http://pagesperso.aol.fr/potahard/
http://pagesperso.aol.fr/jugahard/
http://pagesperso.aol.fr/centrihard/
http://pagesperso.aol.fr/tiphard/
http://pagesperso.aol.fr/seriahard/
http://pagesperso.aol.fr/candehentai/
http://pagesperso.aol.fr/amahentai/
http://pagesperso.aol.fr/iranihistoire/
http://pagesperso.aol.fr/difehistoire/
http://pagesperso.aol.fr/modehistoire/
http://pagesperso.aol.fr/satajeune/
http://pagesperso.aol.fr/iorgejeune/
http://pagesperso.aol.fr/momejeune/
http://pagesperso.aol.fr/radilesbienne/
http://pagesperso.aol.fr/espelesbienne/
http://pagesperso.aol.fr/pasoslesbienne/
http://pagesperso.aol.fr/dososlesbienne/
http://pagesperso.aol.fr/respplesbienne/
http://pagesperso.aol.fr/valmangaa/
http://pagesperso.aol.fr/edarrmanga/
http://pagesperso.aol.fr/sonimanga/
http://pagesperso.aol.fr/enromanga/
http://pagesperso.aol.fr/llamenoire/
http://pagesperso.aol.fr/unionoire/
http://pagesperso.aol.fr/montnoire/
http://pagesperso.aol.fr/dedsnu/
http://pagesperso.aol.fr/creenu/
http://pagesperso.aol.fr/matinnu/
http://pagesperso.aol.fr/nuwrtte/
http://pagesperso.aol.fr/etninu/
http://pagesperso.aol.fr/cakissuceasu/
http://pagesperso.aol.fr/ollasu10/
http://pagesperso.aol.fr/alttranssexuelle/
http://pagesperso.aol.fr/martranssexuelle/
http://pagesperso.aol.fr/buentranssexuell/
http://pagesperso.aol.fr/onapaxxx/
http://pagesperso.aol.fr/ounexxx/
http://pagesperso.aol.fr/numxxx/
http://pagesperso.aol.fr/setaxxxxx/
http://pagesperso.aol.fr/mnortax/
http://pagesperso.aol.fr/enteraxx/
http://pagesperso.aol.fr/prioblemx/
http://pagesperso.aol.fr/homerx103/
http://pagesperso.aol.fr/enrixxxx/
http://pagesperso.aol.fr/justaxxxx/
http://pagesperso.aol.fr/oooscarx/
http://pagesperso.aol.fr/idiopor/
http://pagesperso.aol.fr/notipor/
http://pagesperso.aol.fr/psopor/
http://pagesperso.aol.fr/maurpor/
http://pagesperso.aol.fr/alaopor/
http://pagesperso.aol.fr/sosopor/
http://pagesperso.aol.fr/andapor/
http://pagesperso.aol.fr/eirpor/
http://pagesperso.aol.fr/ianaadulte/
http://pagesperso.aol.fr/kikradulte/
http://pagesperso.aol.fr/adelsadulte/
http://pagesperso.aol.fr/oayavoyeur/
http://pagesperso.aol.fr/mocavoyeur/

Re: de

(Anonymous)

2006-10-28 02:45 pm (UTC)

http://www.popyy.cn/music/haomaMTV/784/ 号码MTV
http://www.popyy.cn/music/xingxingyueliangtaiyangMTV/783/ 星星月亮太阳MTV
http://www.popyy.cn/music/zihuaMTV/782/ 紫滕花MTV
http://www.popyy.cn/music/LIVE_bupabupaMTV/781/ LIVE_不怕不怕M
http://www.popyy.cn/music/xinyu/780/ 心雨
http://www.popyy.cn/music/daxizhou/779/ 大喜宙
http://www.popyy.cn/music/weinisimilu/778/ 威尼斯迷路
http://www.popyy.cn/music/qinqin/777/ 亲亲
http://www.popyy.cn/music/yirenshijie/776/ 一人世界
http://www.popyy.cn/music/niangzixie/775/ 娘子写
http://www.popyy.cn/music/gerenmimi/774/ 个人秘密
http://www.popyy.cn/music/danchelianren/773/ 单车恋人
http://www.popyy.cn/music/yigerendeshijielianggerendecuo/772/ 一个人的世界两个人的
http://www.popyy.cn/music/anzou/771/ 暗奏
http://www.popyy.cn/music/bieaiwo xiangaigepengyou/770/ 别爱我 像爱个朋友
http://www.popyy.cn/music/qingningyipiantian/769/ 青柠一片天
http://www.popyy.cn/music/mofansheng/768/ 模范生
http://www.popyy.cn/music/jingjingde/767/ 静静的
http://www.popyy.cn/music/huanghunxiao/766/ 黄昏晓
http://www.popyy.cn/music/yankanxinwudong/765/ 眼看心勿动
http://www.popyy.cn/music/danshenqiantao/764/ 单身潜逃
http://www.popyy.cn/music/jiemeimendijuhuiMTV/763/ 姐妹们地聚会MTV
http://www.popyy.cn/music/keaidezaochenMTV/762/ 可爱的早晨MTV
http://www.popyy.cn/music/naxiehuaerMTV/761/ 那些花儿MTV
http://www.popyy.cn/music/qingchunwuquMTV/760/ 青春舞曲MTV
http://www.popyy.cn/music/I will be there MTV/759/ I will be
http://www.popyy.cn/music/shizijietouMTV/758/ 十字街头MTV
http://www.popyy.cn/music/shalalafangjiaMTV/757/ shalala放假M
http://www.popyy.cn/music/jiemeiMTV/756/ 姐妹MTV
http://www.popyy.cn/music/Around The World MTV/755/ Around The
http://www.popyy.cn/music/I love rock and roll MTV/754/ I love roc
http://www.popyy.cn/music/Sunny day MTV/753/ Sunny day
http://www.popyy.cn/music/aiqing36jiMTV/752/ 爱情36计MTV
http://www.popyy.cn/music/Reflection MTV/751/ Reflection
http://www.popyy.cn/music/bingheMTV/750/ 冰河MTV
http://www.popyy.cn/music/lanseyuMTV/749/ 蓝色雨MTV
http://www.popyy.cn/music/beifengchuiguodexiatianMTV/748/ 被风吹过的夏天MTV
http://www.popyy.cn/music/huatiancuoMTV/747/ 花田错MTV
http://www.popyy.cn/music/qianyanwanyuMTV/746/ 千言万语MTV
http://www.popyy.cn/music/caocaoMTV/745/ 曹操MTV
http://www.popyy.cn/music/ganendexinMTV/744/ 感恩的心MTV
http://www.popyy.cn/music/jimoshazhoulengMTV/743/ 寂寞沙洲冷MTV
http://www.popyy.cn/music/wangbuliaoMTV/742/ 忘不了MTV
http://www.popyy.cn/music/yongganyidianMTV/741/ 勇敢一点MTV
http://www.popyy.cn/music/youduoshaoaikeyizhonglaiMTV/740/ 有多少爱可以重来MT
http://www.popyy.cn/music/zhizhuoMTV/739/ 执着MTV
http://www.popyy.cn/music/Dear Friend MTV/738/ Dear Frien
http://www.popyy.cn/music/When you believe MTV/737/ When you b
http://www.popyy.cn/music/burangwodeyanleipeiwoguoyeMTV/736/ 不让我的眼泪陪我过夜
http://www.popyy.cn/music/ruguoaiMTV/735/ 如果爱MTV
http://www.popyy.cn/music/xibanyayemeiguiMTV/734/ 西班牙野玫瑰MTV
http://www.popyy.cn/music/xiangcaoMTV/733/ 香草MTV
http://www.popyy.cn/music/The girl from MTV/732/ The girl f
http://www.popyy.cn/music/dengdengMTV/731/ 等等MTV
http://www.popyy.cn/music/yingshanhongMTV/730/ 映山红MTV

Re: de

(Anonymous)

2007-02-01 03:08 pm (UTC)

http://www.popyy.cn/music/houhuiyouqi/2979/ 后会有期
http://www.popyy.cn/music/Forever/2978/ Forever
http://poptu.cn/picweb/20067945679456.htm 古香气味风野美女
http://poptu.cn/picweb/20067947479474.htm 阳关娃娃水性香味
http://poptu.cn/picweb/20067949479494.htm 纯净诱热可爱娃娃
http://poptu.cn/picweb/20067951379513.htm 大地优美天真妹妹
http://poptu.cn/picweb/20067953279532.htm 冰凉清香可爱妹妹
http://poptu.cn/picweb/20067955379553.htm 忧郁几分纯香娃娃
http://poptu.cn/picweb/20067957379573.htm 都市可爱女孩古香
http://poptu.cn/picweb/20067959379593.htm 古典风格清香女孩
http://poptu.cn/picweb/20067961379613.htm 个性MM酷野性感
http://poptu.cn/picweb/20067963379633.htm 沙滩丽人活泼美丽
http://poptu.cn/picweb/20067965379653.htm 秀丽迷人郊外MM
http://poptu.cn/picweb/20067967379673.htm 清气香香可爱靓女
http://poptu.cn/picweb/20067969379693.htm 酷酷美丽女孩风情
http://poptu.cn/picweb/20067971379713.htm 幽幽可爱娃娃女生
http://poptu.cn/picweb/20067973879738.htm 秋色夏季优美女孩
http://poptu.cn/picweb/20067976379763.htm 热爱娃娃可爱风情
http://poptu.cn/picweb/20067978879788.htm 可爱娇气学生MM
http://poptu.cn/picweb/20067981379813.htm 纯感灵意天使娃娃
http://poptu.cn/picweb/20067983879838.htm 亭亭少女玲珑可爱
http://poptu.cn/picweb/20067986379863.htm 农场风情郊野美人
http://poptu.cn/picweb/20067988879898.htm 小巧可爱风情MM
http://poptu.cn/picweb/20067991379913.htm 洋气可爱娃娃女生
http://poptu.cn/picweb/20067993879938.htm 野性清纯个性美女
http://poptu.cn/picweb/20067996379963.htm 留外学生白嫰贡献
http://poptu.cn/picweb/20067999879998.htm 阳光淑女清新动人
http://poptu.cn/picweb/20068001380013.htm 城市白领气派女孩
http://poptu.cn/picweb/20067998279982.htm 古典风味沙士美女
http://poptu.cn/picweb/20067999079990.htm 迷人美女清纯可爱
http://poptu.cn/picweb/20068001580015.htm 清凉清新俏小妹妹
http://poptu.cn/picweb/20068003080030.htm 白嫰肉体扭动美感
http://poptu.cn/picweb/20068006080060.htm 成熟野性美丽女人
http://poptu.cn/picweb/20068007480074.htm 优美肥P迷人动感
http://poptu.cn/picweb/20068009680096.htm 引人犯罪激情女郎
http://poptu.cn/picweb/20068011080110.htm 狂野森林动人女人
http://poptu.cn/picweb/20068013080130.htm 强迫逼人少妇身体
http://poptu.cn/picweb/20068015080150.htm 时代女性美丽香气
http://poptu.cn/picweb/20068017180171.htm 现代女人玩法传奇
http://poptu.cn/picweb/20068019080190.htm 动态MM激动风情
http://poptu.cn/picweb/20068021080210.htm 寂寞女生激情摄像
http://poptu.cn/picweb/20068024380243.htm 肉感女郎摆动身躯
http://poptu.cn/picweb/20068025080250.htm 上班一族屋里屋外
http://poptu.cn/picweb/20068028080280.htm 漂亮铜体放送视线
http://poptu.cn/picweb/20068028980289.htm 香野标致优人美女
http://poptu.cn/picweb/20068032080320.htm 优美达标迷人肉P
http://poptu.cn/picweb/20068032880328.htm 美丽纹身另类美感
http://poptu.cn/picweb/20068034880348.htm 风野少女开放迷人
http://poptu.cn/picweb/20068037080370.htm 心香妇人动人娃娃
http://poptu.cn/picweb/20068038880388.htm 纹纹餐桌优美服务
http://poptu.cn/picweb/20068040780407.htm 娇艳欲滴媚骨女郎
http://poptu.cn/picweb/20068043080430.htm 小野非国皮肤光滑
http://poptu.cn/picweb/20068044680446.htm 经典开放成熟女孩
http://poptu.cn/picweb/20068047080470.htm 另类玩法现代激情
http://poptu.cn/picweb/20068048580485.htm 激情妇女动人一面
http://poptu.cn/picweb/20068052080520.htm 白嫰肉体丰满迷人
http://poptu.cn/picweb/20068053080530.htm 乡间生活火爆裸身
http://poptu.cn/picweb/20068056080560.htm 裸体绘画美感逼人
http://poptu.cn/picweb/20068056580565.htm 吧台女朗疯狂肉体
http://poptu.cn/picweb/20068059080590.htm 白嫰成熟少妇尤物
http://poptu.cn/picweb/20068061880618.htm 潮流野性欲火销魂
http://poptu.cn/picweb/20068062680626.htm 学生教师激情生活
http://poptu.cn/picweb/20068065880658.htm 激情缭人肉感肉P
http://poptu.cn/picweb/20068066680666.htm 寂寞女人野性狂爆

You are viewing danwalsh