Understanding SELinux with the `semanage` Command (with examples)

SELinux, or Security-Enhanced Linux, is a robust security architecture that provides mandatory access control (MAC) in the Linux kernel. The semanage command is a vital tool used for managing SELinux policies. This tool helps sysadmins set up rules governing how users and applications can access system resources, ensuring a more secure environment. The semanage command allows you to modify various aspects of SELinux policies, such as booleans, file contexts, and port labels, providing a flexible way to determine the system’s security posture. Here, we explore several use cases of semanage, demonstrating its power and utility in SELinux policy management.

Use case 1: Setting or Unsetting a SELinux Boolean

Code:

sudo semanage boolean -m --modify -1 --on haproxy_connect_any

Motivation:

SELinux booleans are switches that allow sysadmins to modify the behavior of SELinux policies without redefining them completely. By setting a boolean, you can toggle certain features on or off, adapting SELinux enforcement according to immediate needs. For instance, turning on the haproxy_connect_any boolean can be crucial when configuring HAProxy to communicate with any service. This flexibility is essential for balancing security with functionality.

Explanation:

• sudo: Allows the execution of the command with superuser privileges.
• semanage boolean: The subcommand used to modify SELinux booleans.
• -m or --modify: Indicates that a change will be made to the boolean.
• -1 or --on: Specifies that the boolean should be turned on.
• haproxy_connect_any: The specific Boolean to be modified, enabling HAProxy to make outbound connections to any address.

Example Output:

Boolean haproxy_connect_any is turned on

Use case 2: Adding a User-Defined File Context Labeling Rule

Code:

sudo semanage fcontext -a --add -t samba_share_t '/mnt/share(/.*)?'

Motivation:

File context labeling is critical in SELinux, as it dictates the access rights of processes to specific files. By defining custom file contexts, administrators can grant or restrict access to files based on their purpose within different applications. In this example, applying the samba_share_t type to /mnt/share allows Samba to access and manage files within that directory. This operation is essential in environments where Samba share directories are dynamically created and require secure access control.

Explanation:

• sudo: Executes the command with elevated privileges.
• semanage fcontext: The subcommand used to manage file contexts.
• -a or --add: Specifies the addition of a new context mapping rule.
• -t or --type: Indicates the type of SELinux context to assign.
• samba_share_t: The SELinux type for Samba shared directories.
• '/mnt/share(/.*)?': The target directory pattern, with regex allowing recursive file labeling.

Example Output:

File context '/mnt/share(/.*)?' with type samba_share_t added

Use case 3: Adding a User-Defined Port Labeling Rule

Code:

sudo semanage port -a --add -t ssh_port_t -p tcp 22000

Motivation:

Ports are entry points for network communication, and in SELinux, labeling these ports controls which processes can listen on or connect through them. Adding a new port labeling rule is essential when running services on non-default ports, ensuring that only processes with the right SELinux type can use them. If you want to run SSH on port 22000, you must label it with ssh_port_t to maintain secure access.

Explanation:

• sudo: Grants administrative execution permissions.
• semanage port: The subcommand used to manage port labels.
• -a or --add: Specifies the addition of a new port rule.
• -t or --type: Sets the SELinux type for the specified port.
• ssh_port_t: SELinux type indicating that the port is to be used by SSH services.
• -p or --proto: Specifies the protocol (tcp in this case) for the port.
• 22000: The port number to be labeled.

Example Output:

Port 22000/ tcp with type ssh_port_t added

Use case 4: Setting or Unsetting Permissive Mode for a Confined Domain

Code:

sudo semanage permissive -a --add httpd_t

Motivation:

Enabling permissive mode for a specific SELinux domain provides a powerful troubleshooting tool. This mode allows processes associated with the domain to operate without enforcing policy violations, logging issues for review instead. By setting httpd_t to permissive, administrators can diagnose problems with web services without compromising security across the entire system – ideal for detailed analysis in complex web environments.

Explanation:

• sudo: Required for executing high-privilege commands.
• semanage permissive: The subcommand used to toggle permissive mode for domains.
• -a or --add: Indicates permissive mode should be set for the domain.
• httpd_t: The SELinux type for HTTP daemon processes, representing web server operations.

Example Output:

Domain httpd_t set to permissive mode

Use case 5: Exporting Local Customizations

Code:

sudo semanage export -f path/to/file

Motivation:

Exporting SELinux customizations is invaluable for system backups, audits, and migrations. By creating a record of all local policy adjustments, administrators can maintain consistent security settings across different machines or restore settings in case of system failure. This export essentially captures the state of the SELinux configuration, facilitating easier management and compliance verification.

Explanation:

• sudo: Ensures the command runs with necessary privileges.
• semanage export: The subcommand used to output SELinux policy customizations.
• -f or --output_file: Specifies the destination file path for the exported data.

Example Output:

Local customizations exported to path/to/file

Use case 6: Importing a File for Local Customizations

Code:

sudo semanage import -f path/to/file

Motivation:

Importing customizations can be critical when deploying pre-existing SELinux policies to new systems or recovering from a security misconfiguration. This operation reinstates the tailored security rules apt for specific application environments, efficiently bridging configuration gaps. However, caution is advised, as imports may overwrite current configurations, necessitating careful management.

Explanation:

• sudo: Required for executing this potentially impactful operation.
• semanage import: The subcommand to load SELinux policy customizations.
• -f or --input_file: Indicates the file path containing the policy data to import.

Example Output:

Local customizations imported from path/to/file

Conclusion:

The semanage command in SELinux is a powerful asset for system administrators, offering comprehensive control over security policies. By effectively utilizing its subcommands, you can tailor SELinux enforcement to meet the specific demands of your environment, ensuring both flexibility and robust protection. Whether setting booleans, managing contexts, labeling ports, exporting settings, or running domain-specific diagnostics, semanage simplifies complex security architecture management while safeguarding vital system processes.