#SELinux
#SELinux Policies | selinux tutorial for beginners | selinux Explained
SELinux Policy
Policy Organization
Confined and Unconfined Domain
SELinux Policy Behavior
Configuring a Policy with semanage
Example
SELinux Port Labeling
Managing Ports with Semanage
Using Semanage Permissive
Limiting flows based on the network interface
Generating Policy files for Deployment
Handling device files
Setting a SELinux label on a device node
SELinux implements different policies like:
Targeted: This default policy applies access controls to certain (targeted) processes.
MLS: Multi-Level Security
Set the SELINUXTYPE directive in the /etc/selinux/config file:
With the targeted policy, targeted processes run in their own domain, called a confined domain. In a confined domain, the files that a targeted process has access to, are limited. If a confined process is compromised by an attacker, the attacker’s access to resources and the possible damage they can do is also limited. SELinux denies access to these resources and logs the denial.
Specific services are placed into distinct security domains that are confined by the policy.
For example, a user runs in a completely unconfined domain while services that listen on a network for client requests, such as named, httpd, and sshd, run in a specific, confined domain. Processes that are not targeted, run in an unconfined domain. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data. DAC rules still apply in an unconfined domain. kernel_t domain: Unconfined kernel processes run in this domain. unconfined_t domain: Linux users logged in to the system run in this domain. A listing of /etc/selinux with targeted and MLS policies installed :
ll -lrt /etc/selinux/Visit www.theskillpedia.com for Online Training on this technology
selinux policy,selinux,what is selinux policy,disable selinux,selinux sesearch,selinux policy behavior,configure selinux,selinux generating policy files