Using SELinux on an ICE-Linux CMS

ManualsBrandsHP ManualsSoftwareHP Insight Control for Linux v2.0 Media Kit

White Paper

Abstract.............................................................................................................................................. 2

Introduction......................................................................................................................................... 2

Getting Started.................................................................................................................................... 2

Entering Permissive Mode ..................................................................................................................... 2

Collecting Violation Data...................................................................................................................... 3

Writing Policy from Violations ............................................................................................................... 4

Enforce the New Policy ........................................................................................................................ 5

SELinux and Shell Scripting................................................................................................................... 6

Appendix A: The /etc/selinux/config File .............................................................................................. 7

Appendix B: Sample Violation............................................................................................................... 8

Summary ........................................................................................................................................ 8

Detailed Description ......................................................................................................................... 8

Allowing Access .............................................................................................................................. 8

Additional Information ...................................................................................................................... 8

Appendix C: Sample local.te File .......................................................................................................... 9

For more information.......................................................................................................................... 12

Summary of content (12 pages)

PAGE 1
Using SELinux on an ICE-Linux CMS White Paper Abstract.............................................................................................................................................. 2 Introduction......................................................................................................................................... 2 Getting Started ....................................................................................................................................
PAGE 2
Abstract This white paper is intended for IT professionals interested in using ICE-Linux with Security-Enhanced Linux (SELinux) extensions enabled on Central Management Server (CMS) running Red Hat® Enterprise Linux 5 (RHEL 5). This document does not explain how to use SELinux with ICE-Linux on Red Hat Enterprise Linux 4, which is based on a deprecated sample SELinux policy.
PAGE 3
auditd. Policy violation messages are generated by the SELinux Access Vector Cache, or AVC, which tags each of these violations with an AVC. The /etc/selinux/config configuration file controls the SELinux mode of operation, and it is consulted at boot time. Leaving or entering disabled mode will require a reboot; however switching between the permissive and enforcing modes will not.
PAGE 4
Writing Policy from Violations RHEL 5 introduced a mechanism, named policy modules, to change SELinux policy while the system is running. A module is just a modification to the existing policy. To build an SELinux policy module from violations, begin with the AVCs associated with them. They can be found in the sealert GUI beneath the descriptive text for each log entry or in one of two log files: the /var/log/messages file or the /var/log/audit/audit.log file if you're using auditd.
PAGE 5
After the policy sources are verified to allow what should be allowed, and with the .pp file in hand, load it with the following command: # semodule -i local.pp The policy is now loaded, and additional AVC messages from actions previously in violation of the policy should cease to appear.
PAGE 6
SELinux and Shell Scripting In the reference policy shipped with RHEL 5, there are over one hundred built-in policy Boolean variables that can be switched on and off without the need to modify the policy itself or to install a module. This is especially useful when policy needs to be temporarily changed to allow a specific action, such as within a shell script or during an HP SIM task. SELinux policy Booleans are manipulated with the setsebool command.
PAGE 7
Appendix A: The /etc/selinux/config File # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=permissive # SELINUXTYPE= type of policy in use. Possible values are: # targeted - Only targeted network daemons are protected. # strict - Full SELinux protection.
PAGE 8
Appendix B: Sample Violation Summary SELinux is preventing rsync (/usr/bin/rsync) "getattr" to /bin (bin_t). Detailed Description SELinux denied rsync access to /bin. If this is an RSYNC repository, it has to have a file context label of rsync_data_t. If you did not intend to use /bin as an rsync repository, it could indicate either a bug or it could signal an intrusion attempt.
PAGE 9
Appendix C: Sample local.te File module local 1.
PAGE 10
#============= bluetooth_t ============== allow bluetooth_t device_t:sock_file write; allow bluetooth_t initrc_t:unix_dgram_socket sendto; #============= dhcpc_t ============== allow dhcpc_t device_t:sock_file write; allow dhcpc_t initrc_t:unix_dgram_socket sendto; #============= fsdaemon_t ============== allow fsdaemon_t device_t:sock_file write; allow fsdaemon_t initrc_t:unix_dgram_socket sendto; #============= gpm_t ============== allow gpm_t device_t:sock_file write; allow gpm_t initrc_t:unix_dgram_sock
PAGE 11
#============= setroubleshootd_t ============== allow setroubleshootd_t device_t:sock_file write; allow setroubleshootd_t initrc_t:unix_dgram_socket sendto; #============= snmpd_t ============== allow snmpd_t device_t:sock_file write; allow snmpd_t initrc_t:unix_dgram_socket sendto; #============= system_dbusd_t ============== allow system_dbusd_t device_t:sock_file write; allow system_dbusd_t initrc_t:unix_dgram_socket sendto; #============= system_mail_t ============== allow system_mail_t device_t:sock_fi
PAGE 12
For more information www.hp.com/go/ice-linux www.redhat.com/docs/manuals/enterprise/RHEL-5-manual/en-US/RHEL510/Deployment_Guide/s1-SELinuxoverview.html docs.fedoraproject.org/selinux-faq-fc5 www.nsa.gov/selinux/info/docs.cfm fedoraproject.org/wiki/SELinux/Troubleshooting © 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.