3 ms·

> There’s nowhere on the system where you can view the policies and look up why something might or might not work. I always thought I had to be missing somethi

> There’s nowhere on the system where you can view the policies and look up why something might or might not work. I always thought I had to be missing something with SELinux because this is what it seemed like to me and that can't be right. My impression is that the documentation for SELinux is extensive in all of the areas that aren't affecting you but it's really hard to nail down exactly what the policies are, what labels are available, which labels you should be using, and generally how everything interacts. Is there a SELinux Wiki somewhere that I've missed that has a simple breakdown of each and every possible label with interactions? Some tool I can use to generate said list?

totony 5y ago
http://www.selinuxproject.org/page/Main_Page http://www.selinuxproject.org/page/Main_Page has some good resources, but most documentation is aimed at policy developers and not end users.
emmelaich 5y ago
You can install the policy source. It ain't easy but it's there.
chr15p 5y ago
sesearch lets you query the rules on a system. sesearch -A will show you every thing that is allowed, and gives you (a lot of) lines like: allow httpd_t httpd_t:dir { getattr ioctl lock open read search }; Which says that things (i.e. processes) with the httpd_t label are allowed to perform getattr, ioctl, lock, open, read, and search operations on directories with the httpd_t label. ps -Z and ls -Z will then list the labels of processes, and the labels of files and directories. If your processes label does not have an allow rule for your file label for the correct action you are denied. The only trick really is that when it reports a label as say "system_u:system_r:httpd_t:s0" thats 4 different colon separated fields and the only one you really care about is the type field "httpd_t", because thats what the rules are defined for (unless you're the NSA or doing Very Interesting things (the other fields are user, role, and security level, but the default Red Hat etc selinux policies dont use them)) There is no wiki with definitive list of labels because they are just strings and the policy writer can call them what they like, even the _t suffix is just a convention to denote the type.

totony 5y ago

http://www.selinuxproject.org/page/Main_Page http://www.selinuxproject.org/page/Main_Page has some good resources, but most documentation is aimed at policy developers and not end users.

emmelaich 5y ago

You can install the policy source. It ain't easy but it's there.

chr15p 5y ago

sesearch lets you query the rules on a system. sesearch -A will show you every thing that is allowed, and gives you (a lot of) lines like: allow httpd_t httpd_t:dir { getattr ioctl lock open read search }; Which says that things (i.e. processes) with the httpd_t label are allowed to perform getattr, ioctl, lock, open, read, and search operations on directories with the httpd_t label. ps -Z and ls -Z will then list the labels of processes, and the labels of files and directories. If your processes label does not have an allow rule for your file label for the correct action you are denied. The only trick really is that when it reports a label as say "system_u:system_r:httpd_t:s0" thats 4 different colon separated fields and the only one you really care about is the type field "httpd_t", because thats what the rules are defined for (unless you're the NSA or doing Very Interesting things (the other fields are user, role, and security level, but the default Red Hat etc selinux policies dont use them)) There is no wiki with definitive list of labels because they are just strings and the policy writer can call them what they like, even the _t suffix is just a convention to denote the type.