22 SELinux Booleans semanage fcontext restorecon

[root@localhost ~]# ps auxZ | grep http
system_u:system_r:httpd_t:s0    root       5285  0.0  0.4 221940  4980 ?        Ss   14:46   0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0    apache     5290  0.0  0.3 224024  3096 ?        S    14:46   0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0    apache     5291  0.0  0.3 224024  3096 ?        S    14:46   0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0    apache     5293  0.0  0.3 224024  3096 ?        S    14:46   0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0    apache     5294  0.0  0.3 224024  3096 ?        S    14:46   0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0    apache     5295  0.0  0.3 224024  3096 ?        S    14:46   0:00 /usr/sbin/httpd -DFOREGROUND
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 5966 0.0  0.0 112648 956 pts/0 R+ 15:42   0:00 grep --color=auto http
[root@localhost ~]#

if you don't want intruder to access /tmp you have to manage context

[root@localhost ~]# ls -ldZ /tmp/

drwxrwxrwt. root root system_u:object_r:tmp_t:s0       /tmp/

when you mv file, context is persisted,

when you cp file, new context is inheret

========================

in order to manage context - utility semanage

[root@localhost ~]# semanage --help

  {import,export,login,user,port,interface,module,node,fcontext,boolean,permissive,dontaudit}

   ...

...

    port                Manage network port type definitions

    interface           Manage network interface type definitions

    module              Manage SELinux policy modules

    node                Manage network node type definitions

    fcontext            Manage file context mapping definitions

    boolean             Manage booleans to selectively enable functionality

====================

[root@localhost ~]# man semanage-fcontext

DESCRIPTION

       semanage is used to configure certain  elements  of  SELinux  policy  without

       requiring  modification  to  or  recompilation from policy sources.  semanage

       fcontext is used to  manage the default file system labeling  on  an  SELinux

       system.   This  command  maps file paths using regular expressions to SELinux

       labels.

====================

EXAMPLE

       remember to run restorecon after you set the file context

       Add file-context for everything under /web

       # semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"

       # restorecon -R -v /web

       Substitute /home1 with /home when setting file context

       # semanage fcontext -a -e /home /home1

       # restorecon -R -v /home1

       For home directories under top level directory, for example /disk6/home,

       execute the following commands.

       # semanage fcontext -a -t home_root_t "/disk6"

       # semanage fcontext -a -e /home /disk6/home

       # restorecon -R -v /disk6

====================

restorecon  can be used if anything went wrong, it checks that context in directory matches the context in policy

====================

how restorecon works

[root@localhost ~]# cp /etc/hosts .

[root@localhost ~]# ls -Z /etc/hosts

-rw-r--r--. root root system_u:object_r:net_conf_t:s0  /etc/hosts

[root@localhost ~]# ls -Z hosts

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 hosts

[root@localhost ~]# rm /etc/hosts

rm: remove regular file ‘/etc/hosts’? y

[root@localhost ~]# mv hosts /etc/hosts

[root@localhost ~]# ls -Z /etc/hosts

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /etc/hosts

[root@localhost ~]# restorecon -R -v /etc

restorecon reset /etc/hosts context unconfined_u:object_r:admin_home_t:s0->unconfined_u:object_r:net_conf_t:s0

[root@localhost ~]# 

[root@localhost ~]# ls -Z /etc/hosts

-rw-r--r--. root root unconfined_u:object_r:net_conf_t:s0 /etc/hosts

[root@localhost ~]#