RHCSA RHEL 8 - Diagnose and address routine SELinux policy violations

Your support on Ko-Fi is much appreciated:

Join our new discord channel:

Buy CSG Merchandise:

This video is based on RHEL 8.

Video to cover the section 'Diagnose and address routine SELinux policy violations' for the RHCSA (Red Hat Certified System Administrator).

Notes from the video:

SELinux defines access controls for the applications, processes, and files on a system. It uses security policies, which are a set of rules that tell SELinux what can or can’t be accessed, to enforce the access allowed by a policy.

When an application or process, known as a subject, makes a request to access an object, like a file, SELinux checks with an access vector cache (AVC), where permissions are cached for subjects and objects.

If SELinux is unable to make a decision about access based on the cached permissions, it sends the request to the security server. The security server checks for the security context of the app or process and the file. Security context is applied from the SELinux policy database. Permission is then granted or denied.

SELinux had a large number of the contexts already defined, for example the type context is defined for already for processes such as ssh.

As mentioned in previous videos/blogs, you need to use setroubleshoot-server to review the SELinux policy violations. If you haven’t installed already:

# dnf install setroubleshoot-server

To view all current policy violations for SELinux:

To search all logs in the audit log:

# ausearch -m AVC,USER_AVC,SELINUX_ERR

You can also view anything logged in the journal too:

# journalctl -t setroubleshoot

There is a tool that assists with the why it any of the issues were blocked:

# audit2why -a

There also is a tool that attempts to give you resolutions to the issues:

# audit2allow -w -a

Then using the approach recommended, we then can make the relevant change to fix the solution.

Note if you don’t have any voilations I found a good one to easily reproduce was removing access for users to be able to execute files in their directories and then attempting the same. To remove access for a particular user do the following (user1):

# echo "user1:user_u:s0-s0:c0.c1023" `append to` /etc/selinux/targeted/seusers

This will give the usser the user_u context.

The configure the selinux boolean to block the execution of files within their directories:

# setsebool -P user_exec_content off

One run, attempt to login as the user, it should then fail and generate an AVC denial.

#rhcsa #rhel #linux #redhat

[FOUNDERZERO]

Thank you so much for this series! You make great content.

[robd.]

RedHat seems to be adding a new course objective as of Oct 1st. Containers.

[polobandicoot]

thanks for your videos. any updates on the practice exam?

[bikesandstufff]

Is there a typo in "user_u:s0-s0:c0-c1023"? It should be "c9.c1023"

[呪われた-kr]

Hey, Is this playlist completed? Or some topics still left to cover?
Can I pass RHCSA 8 exam following this playlist?
Next month I will be giving my exam.