7. SELinux Targeted Policy (RedHat) - II

Confined and Unconfined states
1. How to Disable Protection of currently protected targeted Daemon (httpd) while SELinux runns at enforcing mode ?
Or
How to Disable a particular domain from SELinux protection while it runs in enforcing mode?
Or
Transition from confined state to unconfined state of a daemon

We will explain this with apache daemon. Lets start configuring apache from confined state to unconfined state.
Steps:

# ps -axZ |grep httpd

    This will show the apache sandbox (Tuple) details or SELinux labeling httpd process .

# cd /selinux

    Inside this directory is a file called httpd_disable_trans, which controlls the httpd upon invication makes the transition from the default unconfined_t (unconfined) to httpd_t (confined)

Step: 1

# echo "1 1" > /selinux/booleans/httpd_disable_trans

    The file is overwritten by two values "1 1". The first value "1" is related to the currently running status of the daemon with respect to SELinux i.e, the service is currently being protected and the other value "1" is the pending value.
Step: 2

# echo "1" > /selinux/commit_pending_bools

    This makes the changes to booleans immediately, reloads  SELinux policy (None of the other domains are effected)
Step: 3

# service httpd restart

    This cause the httpd service reload finishes the transition from confined (httpd_t) sandbox to unconfined (unconfined_t) sandbox, "which is not protected by the Targeted Policy ". This means the httpd service will be behaving like a typical Linux service.

# ps -axZ |grep httpd

    Now we can notice that the httpd has been moved from confined to unconfiend.

2. Changing back httpd from unconfined  to confined context.

# echo "0 0" > /selinux/booleans/httpd_disable_trans
# echo "1" > /selinux/commit_pending_bools
# service httpd restart
# ps -axZ

    Now we can see that the httpd is running in confined.

6. SELinux Targeted Policy (RedHat) - I

Introduction:
    Here we will discuss about the daemons that supported with Targeted Policy. The Targeted policy in SELinux is specifically designed for RHEL and not applied to other Linux Distros. The idea of Targeted policy in SELinux is to protect vulnerability/highly utilized daemons/services of RHEL Servers. Each daemon is essentially sandboxed in targeted policy.i.e, daemons are restricted to some area and unable to interact to
other area/domains.
List of daemons protected by Targeted Policy by default.
Confined:

1. dhcpd
2. httpd
3. mysql
4. named
5. nscd - name service caching daemon
6. ntpd
7. portmap
8. postgresql
9. snmpd
10. squid
11. syslogd
12. winbindd

Unconfined:
  13. All other process
    The first 12 process mentioned above are the daemons which is protected as confined domains in Tuple (httpd_t, squid_t,snmp_t etc) and all other programs/subject/process are included in the unconfined (unconfined_t) domains in Targeted Policy. The Targeted policy restricts from communicating one domain with the other, i.e, dhcpd_t from httpd_t, which can be called as sandboxed.

5. SELinux With Baisc Linux Commands

    The following commands with "-Z" reveals along with the context information specifically for each commands.

• ps -Z
• ls -Z
• cp -Z
• id -Z
• mv -Z

# id

uid=500(user1) gid=500(user1) groups=500(user1) context=user_u:system_r:unconfined_t

or

# id -Z

user_u:system_r:unconfined_t

This shows the information about the user ID and the context information of the user(SELinux label of user). i.e,  id -Z reveals current security context of users

# ps -Z

Shows the ps run by the user and the labeling information of each process. i.e, ps -Z reveals various domains in Tupals[SUBJECTS].

# ls -Z

Reveals the security context of files/directories[OBJECTS]

# cp

Copying a file will result in inheriting the targeted folder type context. Make sure that the context is verified once the file has been copied.

# mv

Moving a file will preserve the security context.