In this video, you'll learn about SCLinux labels.
SCLinux labels are the essence of SCLinux.
All items are using context labels.
And this context label is supplied to files,
to directories, to ports, and even users can use them.
Many commands have an option minus uppercase Z
that allows you to print label information.
The context type is the most important part of the labels.
Let me show you before going on.
So I'm going to show you ls minus lz on var www.
I like showing you that because var www
is where you find the default document route.
This highlighted here is the context label.
It consists of four parts.
The first part is system underscore u.
That's the user part.
Second part is the role part.
They don't matter.
The only part that matters is httpd syscontent t.
The user and role are only used in very specific situations.
And I will teach you what to do with this httpd syscontent t.
It identifies the access permissions of this HTML directory
as such that the process that comes in with httpd underscore t
can read the contents.
S0 has to deal with SELinux categories.
That is for multi-category and multi-layer security.
That's something we don't discuss in Linux+.
Now back to the so-called context type.
Here you can see that on CGI bin,
the context type is httpd sysscript xact.
Now why is that?
Well, that is because in the CGI bin directory,
you can find scripts.
And these scripts need execute permission.
And in order to allow scripts to execute,
we have a specific context label, httpd sysscript xact.
If you want to manage context labels,
semanagefcontext is the command to use.
And if you use this command to set context labels on files,
you write the context to the policy.
Now that is not enough, because from the policy,
the context also needs to be applied to the files.
And to do so, you use the resource-con command.
That will apply from the policy to the inodes.
That is always what is happening.
The policy has the default desired state.
And to implement it, resource-con needs to be run.
And if at any time your SC Linux system has gone unprotected
because it was in disabled mode,
you know what's going to happen?
Auto-relabel is going to happen.
We already have seen that happening
after I entered the disabled mode in my previous demo.
You can also set context on ports.
SEManagePort is how to do that.
Now, one big challenge of working with context
is that you need to find the required label.
If default settings are used,
context labels normally don't have to be changed.
What does that mean?
Well, in the case of Apache,
if you put your index.html in the default document route,
there's nothing that you need to do.
If non-default settings are used,
you have to find the appropriate label.
And to do so, you use the following approach.
First, you see the default settings.
That's what we just did.
I use ls-z on var www
to see the default context labels on the directories in there.
Also, you can install the sc-linux-policy-doc package
and consult man-k underscore sc-linux.
That is giving a wide range of SC Linux-related manpages
with lots of information about how to use it.
And the last trick is to use the messages
that are generated by se-alert.
I'll show you later how to do that
when we talk about SC Linux troubleshooting.
For now, I'd like to show you how to set the context
on this web server document route.
So what was the problem?
Well, the problem is that my web server document route
doesn't work.
And when I use grep-avc on var log audit,
audit.log again, we can understand the problem.
I'm only taking out the last line
because the message is always the same.
It's telling me about an s-context.
That's a source context.
That is the context that is used by the command httpd,
which is listed here.
And the relevant part is stating that the source context
is httpd underscore t.
Now we have the target context,
which is the context that is applied
to the file that we are trying to access.
And that is set to default underscore t.
And that is what is wrong here.
SC Linux doesn't allow httpd underscore t
to access default underscore t
because SC Linux is used to protect unauthorized access.
So SC Linux wants controlled access
and default underscore t that is uncontrolled
because that's a default.
That's just anything.
So what do we need?
Well, we can still see it here.
If it's a document route,
this html directory is a document route.
So httpd syscontent t is a document route
that I need to set.
On which?
Well, let me show you ls-ldz on slash web.
Well, slash web currently has default underscore t.
Now how do we do that?
I would advise use man sc-manage-f context.
sc-manage is the main command to manage SC Linux stuff.
sc-manage works with subcommand
and the structure is sc-manage hyphen subcommand.
Use the man page, go all the way down,
and you can see examples.
Now this example is very easy.
It's so easy that I'm just going to copy it
and I'm going to paste it
so that I have the example on screen
and then I'm typing sc-manage-f context.
I like typing it because if you type it a lot,
there will be a moment that you start remembering.
Minus a for add, minus t for the context type
and the context type is going to be set to httpd syscontent t
and we do that on slash web
and this here is a regular expression
that indicates that you want to apply it
to anything below the slash web directory.
And then the second part is restore con
minus rv on slash web.
That will apply the new context from the policy to the directory
and the result, well, if I use my curl localhost command again,
even if we are in enforcing mode right now,
it's working.
Oops, we were still in permissive mode.
Well, that's an easy change.
Set enforce enforcing
and we will see that it is still working.