Demystifying SELinux: WTF is it saying? Dave Quigley SELinux Ninja/Linux Kernel Developer dpquigl@davequigley.com www.davequigley.com/dquigley www.davequigley.com/selinux

Access Controls determine who/what can access system resources What is Access Control? Access Controls determine who/what can access system resources

What You're Use To Web Content Home Directory Files Sensitive Credit Card Data Dave (Apache) Dave (Firefox)

A “New” Type of Access Controls Web Content TCP Port 80 Sensitive Credit Card Data Database Socket Apache Logs Dave (Apache) Dave (PostgreSQL) Database Files

What is SELinux? SELinux is a label based security system Every process has a label, every object on the system has a label Files, Directories, network ports … The SELinux policy controls how process labels interact with other labels on the system The kernel enforces the policy rules

All information needed for SELinux to make an access control decision What is a Label? -rw-r--r-- root root system_u:object_r:etc_t:s0 /etc/passwd DAC Components Security Label system_u:object_r:etc_t:s0 User Role Type MLS All information needed for SELinux to make an access control decision

How do I see Labels? Files Processes Ports ls -Z ps -Z, pstree -Z netstat -Z, semanage ports -l

How to tell if something is wrong? Logged to /var/log/messages if no auditd or during early boot before auditd. grep avc /var/log/messages Logged to /var/log/audit/audit.log if running auditd. /sbin/ausearch -mAVC,SELINUX_ERR -i Notification via setroubleshoot if running. /var/log/audit/audit.log, desktop pop-up

Most Common SELinux Problems Incorrect Labeling Non-Default Config of a Confined Program Bug in Policy or an Application Your machine may have been compromised

Labeling Problems Every process and object on the system is labeled If labels are not correct access may be denied Causes Alternative paths (semanage fcontext) Files created in wrong context (restorecon) Processes started in wrong context

Usecase: Move instead of copy Administrator uploads and extracts a tarball of static web content to his home directory Administrator moves the files into the document root for www.example-labels.com Administrator tries to access site Access fails, why?

Non-Default Configuration SELinux needs to know how a confined daemon is configured Non-default directories Need to ensure files are labeled properly Booleans Allow optional functionality to be enabled Non-default ports Need to ensure ports labeled properly

Usecase: Non Default Location Administrator decides to setup a website www.example-opt.com with the location of /opt/www Administrator creates the directory and copies files into it. Administrator tries to access site Page access fails, why?

Usecase: Web content in user home directories Administrator decides to setup a website www.example-userhome.com to allow users to host personal webpages. Administrator enables Userdirs to public_html. Administrator tries to access site www.example- userhome.com/~sedemo Page access fails, why?

Usecase: Apache on a non-standard port Administrator decides to change the port his apache server at www.example-port.com to 10321 to heighten security. Administrator changes the listening port in the config. Administrator tries start httpd. Server fails to start, why?

Bugs in Policy/Apps SELinux policy bugs Incomplete policy (unusual code path) Unknown application configuration Application bugs Leaked File Descriptors Executable Memory (execmem) Badly built libraries (execmem and others)

Bugs in Policy/Apps (2) Options Report bugs in bugzilla (Best long term solution) Create a policy module (Temporary fix) Labeling is correct? No appropriate booleans? Use audit2allow to create a policy module Examine resulting policy Make sure it's safe Ask for help (#fedora-selinux and mailing lists)

Your machine may have been compromised Current tools not good at differentiating Warning signs: a confined domain tries to: Load a kernel module Turn off SELinux enforcing mode Write to etc_t or shadow_t Modify iptables rules Sendmail others You may be compromised

Resources Google+ SELinux SELinux Community Websites www.selinuxproject.or g Mailing Lists Fedora SELinux NSA SELinux IRC #selinux on FreeNode Presentation files https://github.com/dpq uigl/demystifying- selinux

Questions?

Survey Thank you for listening to me talk. Please help improve the talk by filling out a quick survey at http://goo.gl/S3QGk