Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Programming
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Databases
Mail Systems
openSolaris
Eclipse Documentation
Techotopia.com
Virtuatopia.com
Answertopia.com

How To Guides
Virtualization
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Windows
Problem Solutions
Privacy Policy

  




 

 

Red Hat Enterprise Linux 9 Essentials Book now available.

Purchase a copy of Red Hat Enterprise Linux 9 (RHEL 9) Essentials

Red Hat Enterprise Linux 9 Essentials Print and eBook (PDF) editions contain 34 chapters and 298 pages

Preview Book

2.3. Unconfined processes

Unconfined processes run in unconfined domains. For example, init programs run in the unconfined initrc_t domain, unconfined kernel processes run in the kernel_t domain, and unconfined Linux users run in the unconfined_t domain. For unconfined processes, SELinux policy rules are still applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them.
The following example demonstrates how the Apache HTTP Server (httpd) can access data intended for use by Samba, when running unconfined. Note: in Red Hat Enterprise Linux, the httpd process runs in the confined httpd_t domain by default. This is an example, and should not be used in production. It assumes that the httpd and wget packages are installed, that SELinux targeted policy is used, and that SELinux is running in enforcing mode:
  1. Run the sestatus command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used:
    $ /usr/sbin/sestatus
    SELinux status:                 enabled
    SELinuxfs mount:                /selinux
    Current mode:                   enforcing
    Mode from config file:          enforcing
    Policy version:                 24
    Policy from config file:        targeted
    
    SELinux status: enabled is returned when SELinux is enabled. Current mode: enforcing is returned when SELinux is running in enforcing mode. Policy from config file: targeted is returned when the SELinux targeted policy is used.
  2. As the root user, run the touch /var/www/html/test2file command to create a file.
  3. Run the ls -Z /var/www/html/test2file command to view the SELinux context:
    -rw-r--r--  root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/test2file
    
    test2file is labeled with the SELinux unconfined_u user because a Linux user that is mapped to the unconfined_u SELinux user created the file. RBAC is used for processes, not files. Roles do not have a meaning for files - the object_r role is a generic role used for files (on persistent storage and network file systems). Under the /proc/ directory, files related to processes may use the system_r role.[4] The httpd_sys_content_t type allows the httpd process to access this file.
  4. The chcon command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the semanage command, which is discussed later. As the root user, run the following command to change the type to a type used by Samba:
    chcon -t samba_share_t /var/www/html/test2file
    Run the ls -Z /var/www/html/test2file command to view the changes:
    -rw-r--r--  root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/test2file
    
  5. Run the service httpd status command to confirm that the httpd process is not running:
    $ /sbin/service httpd status
    httpd is stopped
    
    If the output differs, run the service httpd stop command as the root user to stop the httpd process:
    # /sbin/service httpd stop
    Stopping httpd:                                            [  OK  ]
    
  6. To make the httpd process run unconfined, run the following command as the root user to change the type of /usr/sbin/httpd, to a type that does not transition to a confined domain:
    chcon -t unconfined_exec_t /usr/sbin/httpd
  7. Run the ls -Z /usr/sbin/httpd command to confirm that /usr/sbin/httpd is labeled with the unconfined_exec_t type:
    -rwxr-xr-x  root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd
    
  8. As the root user, run the service httpd start command to start the httpd process. The output is as follows if httpd starts successfully:
    # /sbin/service httpd start
    Starting httpd:                                            [  OK  ]
    
  9. Run the ps -eZ | grep httpd command to view the httpd processes running in the unconfined_t domain:
    $ ps -eZ | grep httpd
    unconfined_u:system_r:unconfined_t 7721 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7723 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7724 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7725 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7726 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7727 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7728 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7729 ?      00:00:00 httpd
    unconfined_u:system_r:unconfined_t 7730 ?      00:00:00 httpd
    
  10. Change into a directory where your Linux user has write access to, and run the wget https://localhost/test2file command. Unless there are changes to the default configuration, this command succeeds:
    --2009-12-01 11:55:47--  https://localhost/test2file
    Resolving localhost... 127.0.0.1
    Connecting to localhost|127.0.0.1|:80... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 0 [text/plain]
    Saving to: `test2file.1'
    
    [ <=>                            ]--.-K/s   in 0s      
            
    2009-12-01 11:55:47 (0.00 B/s) - `test2file.1' saved [0/0]
    
    Although the httpd process does not have access to files labeled with the samba_share_t type, httpd is running in the unconfined unconfined_t domain, and falls back to using DAC rules, and as such, the wget command succeeds. Had httpd been running in the confined httpd_t domain, the wget command would have failed.
  11. The restorecon command restores the default SELinux context for files. As the root user, run the restorecon -v /usr/sbin/httpd command to restore the default SELinux context for /usr/sbin/httpd:
    # /sbin/restorecon -v /usr/sbin/httpd
    restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_exec_t:s0->system_u:object_r:httpd_exec_t:s0
    
    Run the ls -Z /usr/sbin/httpd command to confirm that /usr/sbin/httpd is labeled with the httpd_exec_t type:
    $ ls -Z /usr/sbin/httpd
    -rwxr-xr-x  root root system_u:object_r:httpd_exec_t   /usr/sbin/httpd
    
  12. As the root user, run the /sbin/service httpd restart command to restart httpd. After restarting, run the ps -eZ | grep httpd to confirm that httpd is running in the confined httpd_t domain:
    # /sbin/service httpd restart
    Stopping httpd:                                            [  OK  ]
    Starting httpd:                                            [  OK  ]
    # ps -eZ | grep httpd
    unconfined_u:system_r:httpd_t    8880 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8882 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8883 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8884 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8885 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8886 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8887 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8888 ?        00:00:00 httpd
    unconfined_u:system_r:httpd_t    8889 ?        00:00:00 httpd
    
  13. As the root user, run the rm /var/www/html/test2file command to remove test2file.
  14. If you do not require httpd to be running, as the root user, run the service httpd stop command to stop httpd:
    # /sbin/service httpd stop
    Stopping httpd:                                            [  OK  ]
    
The examples in these sections demonstrated how data can be protected from a compromised confined process (protected by SELinux), as well as how data is more accessible to an attacker from a compromised unconfined process (not protected by SELinux).


[4] When using other policies, such as MLS, other roles may also be used, for example, secadm_r.


 
 
  Published under the terms of the Creative Commons License Design by Interspire