SELinux administration
Contexts, policies and resolving denied accesses.
Level 301 · 16 lessons · 15 practice labs
Lessons
Modes and contexts
- SELinux status: enforcing and permissive: You will understand the difference between SELinux enforcing and permissive modes and how to check which one the system is in.
- SELinux persistent mode configuration: You will learn the configuration that keeps the SELinux mode after a reboot, and the risks of changing it permanently.
- SELinux security contexts and labels: You will understand what the SELinux labels on files and processes mean and how they are used to decide access.
- Process domains: ps -Z and type enforcement
- Fixing SELinux label mismatches with restorecon: You will learn to notice when a file's SELinux label does not match what is expected and to restore the correct label with restorecon.
- Defining persistent file contexts with semanage fcontext: You will add a context rule for a custom directory and apply it with restorecon so it survives relabelling.
- Short task: permanently fix the labels of moved web content
Adjusting the policy
- SELinux booleans: You will learn that SELinux booleans are simple switches in the policy, and how to safely turn on only the permission a service needs.
- Running a service on a nonstandard port with SELinux: You will understand why SELinux blocks a service on a nonstandard port, and how to correctly tell the policy about that port.
- Reading SELinux AVC denials: You will read AVC messages, the records of accesses SELinux blocked, and understand who could not reach what, and why.
- SELinux: sealert and audit2allow: You will learn how the SELinux tools sealert and audit2allow explain a denied access, and why you must judge their suggested fix before applying it.
- Writing and loading a small policy module
- Short task: resolve a denied access with the narrowest permission
Containers and capstone
- SELinux and container volumes: solving labelling problems: You will fix a SELinux denial on a directory mounted into a Podman container using a context option.
- Confined users: user_u and staff_u
- Capstone: fix a web server's SELinux problems: Capstone: on a fictional company's web server, you find from the logs what SELinux is blocking and fix it without turning SELinux off.
Practice labs
- Fix the labels of moved web files: Find files with the wrong context using ls -Z, fix them with restorecon and show the page loads.
- Define a persistent context for a custom data folder: Assign the right type to a new folder with semanage fcontext, run restorecon and show it survives a relabel.
- Fix the access error for pages served from home directories: Work out why userdir pages return 403 in terms of context and booleans and apply the narrowest fix.
- Close the access a mislabelled file opened up: Find a secret file labelled with the web content type, relabel it correctly and prove the web server can no longer read it.
- Let the web server connect to the database: Find the right boolean for the denied connection, turn it on persistently and show the app connects.
- Allow a service running on a non-standard port: See the service fail to start on 8443, add the port to the right type with semanage port and start it.
- Switch back the booleans that were opened too widely: Compare changed booleans with the defaults, turn off the unneeded ones and show the application keeps working.
- Read an AVC record and say what was blocked: Find the latest denial with ausearch and state source, target, class and permission in plain words.
- Weigh the sealert advice and choose the right fix: Prefer the labelling fix over a policy module among the options sealert offers and write down why.
- Load a small policy module with the narrowest permission: Strip the excess rights from audit2allow output, build and load a module with only what is needed and show the denial ends.
- Move a server left in permissive mode to enforcing: Check the running and persistent modes, set both to enforcing and show it holds after a reboot.
- Debug a problem with only one domain set to permissive: Without loosening the whole system, make one service domain permissive, collect the denial, fix it and revert the domain.
- Solve a container volume permission error with labels: Show the container cannot reach its mounted folder, apply the right label using the :Z and :z difference and verify.
- Map a user to a confined SELinux user: Map the intern account to user_u, show it cannot use sudo or su and list the mapping.
- Build an SELinux mapping that limits a helpdesk account to its job: Map the account to staff_u, let it switch through sudo only to a role that restarts services, and prove a forbidden action is denied with an AVC record.
About this course
Contexts, policies and resolving denied accesses.
What you will learn
- Modes and contexts
- Adjusting the policy
- Containers and capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.