Security-Enhanced Linux (SELinux) is the default context-based permissions scheme provided with CentOS and Red Hat Enterprise Linux, and is optionally available on other distributions. It was developed by the U.S. National Security Agency (NSA). It provides additional file system and network security so that unauthorized processes cannot access or tamper with data, bypass security mechanisms, violate security policies, or execute untrustworthy programs.
There are three types of SELinux modes; they are as follows:
- Enforcing: In this mode, SELinux enforces its policies onto the system and makes sure that all access by unauthorized users or processes are denied. These access denial events are also logged in to the system as well, which we will look into later on in this chapter.
- Permissive: This is like a semi-enabled mode state where SELinux doesn’t deny any access as the policies are in permissive mode. This is the best mode to test the SELinux policies.
- Disabled: In this mode, the SELinux is in a completely disabled state and no logs are created or permissions are denied.
From the command line, we can use the chcon utility to change the context for a file. This will allow us to define the user, the role, and the type for the file we want to alter, and similar to other filesystem utilities such as chmod or chown, we can also affect files recursively, so it’s easy to set a full folder hierarchy to the desired context.
For example:
# chcon -t user_home_t /var/www/html/index.html
chcon Command Examples
1. View security context of a file:
# ls -lZ path/to/file
2. Change the security context of a target file, using a reference file:
# chcon --reference=reference_file target_file
3. Change the full SELinux security context of a file:
# chcon user:role:type:range/level filename
4. Change only the user part of SELinux security context:
# chcon -u user filename
5. Change only the role part of SELinux security context:
# chcon -r role filename
6. Change only the type part of SELinux security context:
# chcon -t type filename
7. Change only the range/level part of SELinux security context:
# chcon -l range/level filename