Security Guide #

SELinux was developed as an additional Linux security solution that uses the security framework in the Linux kernel. The purpose was to allow for a more granular security policy that goes beyond the standard Discretionary Access Controls (DAC), the traditional file permissions of owner/group/world, and read/write/execute.

SELinux uses labels attached to objects (for example, files and network sockets) and uses them for access decisions.

SELinux default action is to deny any access. SELinux allows only actions that were specifically allowed in the SELinux policy. Another feature of SELinux that increases security is that SELinux allows strict confinement of processes up to the point where the processes cannot access files of other processes on the same system.

SELinux was designed to enhance existing security solutions, not to replace them. For example, discretionary access control (DAC) is still applied even if the system is using SELinux. If DAC denies access first, SELinux is then not used as the access was already blocked by another mechanism.

SELinux is installed by default when installing SLE Micro by YaST or is part of the pre-built images. In systems installed manually by YaST, SELinux is in the disabled mode by default, and the file system is not labeled. If you deployed your system using the pre-built images, the SELinux mode is permissive, and the file system is labeled.

To set the SELinux mode to enforcing and configure your system properly for using SELinux, run the following command:

# transactional-update setup-selinux

Reboot your system after the command completes. The command installs the SELinux policy if it is not installed, sets the enforcing SELinux mode and rebuilds initrd.

SELinux can run in one of three modes: disabled, permissive, or enforcing.

Using the disabled mode means that no rules from the SELinux policy are applied and your system is not protected. Therefore, the disabled mode is not recommended.

In the permissive mode, SELinux is active, the security policy is loaded, the file system is labeled and access denial entries are logged. However, the policy is not enforced and thus no access is actually denied.

In the enforced mode, the security policy is applied. Each access that is not explicitly allowed by the policy is denied.

You can switch between the enforcing and permissive modes by using the setenforce command. Alternatively, you can switch between all SELinux modes by editing the /etc/selinux/config configuration file. Changes performed by the setenforce command are valid only until the next reboot. For persistent changes of the SELinux mode, edit the /etc/selinux/config configuration file.

The setenforce command has the following syntax:

# setenforce MODE_ID

where MODE_ID is 0 for the permissive mode or 1 for the enforced mode.

To verify the mode, run the following command:

# getenforce

The command should return permissive or enforced, depending on the provided MODE_ID.

To change the SELinux mode permanently, in the file /etc/selinux/config change the value of SELINUX to disabled, or permissive, or enforced as follows:

SELINUX=disabled

The changes in the file are applied after next reboot.

Note: Relabeling your system after switching from the disabled mode

If you disable SELinux on your system and then enable it later, make sure that you relabel your system. When SELinux is disabled and you perform changes to your file system, the changes are not reflected in the context anymore (for example, new files do not have any context), therefore you need to relabel your system by using the restorecon command, using the autorelabel boot parameter, or by creating a file that will trigger relabeling on the next boot. To create the file, run the following command:

# touch /etc/selinux/.autorelabel

After reboot, the file /etc/selinux/.autorelabel is replaced with another flag file: /etc/selinux/.relabelled to prevent relabeling on subsequent reboots.

The policy is the key component in SELinux. Your SELinux policy defines rules that specify which objects can access which files, directories, ports, and processes on a system. To do this, a security context is defined for all of these.

An SELinux policy contains a huge number of rules. To make it more manageable, policies are often split into modules. This allows administrator to switch protection on or off for different parts of the system.

When compiling the policy for your system, you will have a choice to either work with a modular policy, or a monolithic policy, where one huge policy is used to protect everything on your system. It is strongly recommended to use a modular policy and not a monolithic policy. Modular policies are much easier to manage.

SLE Micro is shipped with the targeted SELinux policy.

The security context is a set of information assigned to a file or a process. It consists of SELinux user, role, type, level and category. This information is used to make access control decisions.

In the default deployment of SLE Micro, regardless of the deployment method, some of the commands for managing SELinux are not installed. To install the commands described further, run the following command:

# transactional-update pkg install policycoreutils-python-utils

After successful installation and rebooting your system, you will be able to use the commands to manage your system.

Note: The Z option available to other commands

You can also use the Z option with other commands, for example: cp, ps, and id.