Mastering SELinux: Advanced Security Configuration and Policies

Security is one of the main concerns for sysadmins and DevOps engineers. SELinux (Security-Enhanced Linux) offers a robust set of features to strengthen security on Linux systems. This article will guide you through the advanced features of SELinux, including configuration, creating custom policies, and practical use cases.

What is SELinux and why is it important?

SELinux is a mandatory access control (MAC) security architecture integrated into the Linux kernel. It provides a mechanism to support multiple security domains and is used to confine programs and processes. The importance of SELinux lies in its ability to provide an additional layer of security, reducing the risk of vulnerability exploitation.

Configuring SELinux

The configuration of SELinux is done through the /etc/selinux/config file. Let's see how to enable and configure SELinux.

SELINUX=enforcing
SELINUXTYPE=targeted

In this example, SELinux is configured to operate in enforcing mode, which means that policies are enforced and access is denied according to the defined rules. The targeted type applies protections to a selected set of services and daemons.

Creating Custom Policies

SELinux policies are defined in modules. A module consists of a policy file and an interface file. Let's create a simple policy to allow a service to access a specific directory.

# Criar diretório e definir contexto de segurança
sudo mkdir /var/myapp
sudo chcon -t httpd_sys_content_t /var/myapp

# Criar arquivo de política
sudo tee /var/tmp/myapp.te >/dev/null <<'EOF'
module myapp 1.0;

require {
    type httpd_t;
    type httpd_sys_content_t;
    class dir { read getattr };
}

#============= httpd_t ============

allow httpd_t httpd_sys_content_t:dir { read getattr };
EOF

# Compilar e instalar a política
sudo checkmodule -M -m -o /var/tmp/myapp.mod /var/tmp/myapp.te
sudo semodule_package -o /var/tmp/myapp.pp -m /var/tmp/myapp.mod
sudo semodule -i /var/tmp/myapp.pp

Practical Use Cases

Protecting a Web Server

One of the most common uses of SELinux is protecting web servers. Let's see how to configure SELinux for an Apache server.

# Instalar Apache
sudo apt install apache2 # Para Debian/Ubuntu
sudo yum install httpd # Para CentOS/RHEL

# Iniciar e habilitar o serviço
sudo systemctl start apache2
sudo systemctl enable apache2

# Verificar contextos de segurança
ls -Z /var/www/html

Container Isolation

SELinux can also be used to improve the security of Docker containers. Let's see how to apply SELinux policies to a container.

# Criar um container com SELinux habilitado
sudo docker run -d --security-opt label=type:svirt_sandbox_t --name myapp myapp-image

# Verificar contextos de segurança do container
sudo docker exec -it myapp ls -Z /var/myapp

Why This Matters / When to Use

SELinux is crucial in environments where security is a priority. It should be used on production servers, especially those exposed to the internet, such as web servers, databases, and critical applications. SELinux provides an additional layer of security that can prevent attacks and reduce the impact of vulnerabilities.

Connection with LPI/CompTIA Certifications

Mastering SELinux is essential for sysadmins and DevOps engineers seeking LPI (Linux Professional Institute) and CompTIA certifications. The LPI 202-450 certification, for example, covers advanced security topics, including SELinux. Understanding and applying SELinux not only improves system security but also prepares you for these certification exams.