danwalsh (danwalsh) wrote,

10 things you probably did not know about SELinux.. #6

#6 How did those SELinux labels get there?

SELinux labels are placed on disk during the installation by a combination of Anaconda and rpm.  Anaconda actually includes the latest /etc/selinux/targeted/files/file_context and /etc/selinux/targeted/policy/policy.26 in its initrd.  When anaconda starts rpm, rpm reads this file and proceeds to place the labels on disk.  RPM has SELinux awareness built into it and asks the kernel to place the default label on the disk for every object that it creates from its payload.  If an rpm post install script runs during the install, the labels are created using the standard process labelling described below.   Any file system objects created by Anaconda  before loading the policy into the kernel will be relabelled by Anaconda using restorecon.

Any file system objects created by the post install scripts, or during boot, or by any process from then moving forward will create the file via one of the following three rules.
  • The object will get the label of the parent directory.
    • Files/Directories created in /etc, which is labelled etc_t, will get labelled etc_t by default.
  • File transition rules can be written into policy.  File transition rules take into account the label of the process creating the file as well as the parent directory.  For example I can write a rule that says if NetworkManager_t creates a file in a directory labelled etc_t then this file will be labelled net_conf_t
    •  filetrans_pattern(NetworkManager_t, etc_t, net_conf_t, file)
    • When NetworkManager creates the /etc/resolv.conf file it gets labelled net_conf_f rather then etc_t.
    • Since you can only have one combination of ProcessLabel/DirectoryLabel/ObjectClass, you can not currently write a rule for a process to create two different labels within the same directory.
  • The last way is to build SELinux awareness within an application. 
    • Applications can be programmed to ask the kernel to create a file system object with a particular label.
      • rpm, udev, passwd are examples of applications that request the kernel to label the object at creation time.
    • Applications can attempt to change a label from one label to another.
      • restorecon, udev, restorecond, chcon are examples of applications that modify labels.
In Fedora 16 we are introducing a new concept which we are calling File Name Transitions.   These will allow policy writers to take into account the actual file name (Not path) at file creation time,  giving us the ability to clear up some common bugs users have seen with SELinux.

Read about it here and if you are running Fedora 16/Rawhide try it out...


  • Post a new comment


    Anonymous comments are disabled in this journal

    default userpic

    Your reply will be screened