Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 768 / 848

Chapter 44. Security and SELinux
742
44.6.4. LSPP Certification
Efforts are being made to have Linux certified as an MLS operating system. The certification is
equivalent to the old B1 rating, which has been reworked into the
Labeled Security Protection Profile
3
under the
Common Criteria
4
scheme.
44.7. SELinux Policy Overview
This chapter is an overview of SELinux policy, some of its internals, and how it works. It discusses the
policy in general terms, while
Section 44.8, “Targeted Policy Overview”
focuses on the details of the
targeted policy as it ships in Red Hat Enterprise Linux. This chapter starts with a brief overview of what
policy is and where it resides.
Following on from this, the role of SELinux during the boot process is discussed. This is followed by
discussions on file security contexts, object classes and permissions, attributes, types, access vectors,
macros, users and roles, constraints, and a brief discussion summarizing special kernel interfaces.
44.7.1. What is the SELinux Policy?
The SELinux Policy is the set of rules that guide the SELinux security engine. It defines
types
for file
objects and
domains
for processes. It uses roles to limit the domains that can be entered, and has
user identities to specify the roles that can be attained. In essence, types and domains are equivalent,
the difference being that types apply to objects while domains apply to processes.
44.7.1.1. SELinux Types
A type is a way of grouping items based on their similarity from a security perspective. This is not
necessarily related to the unique purpose of an application or the content of a document. For example,
a file can have any type of content and be for any purpose, but if it belongs to a user and exists in that
user's home directory, it is considered to be of a specific security type,
user_home_t
.
These object types are considered alike because they are accessible in the same way by the same
set of subjects. Similarly, processes tend to be of the same type if they have the same permissions
as other subjects. In the targeted policy, programs that run in the
unconfined_t
domain have an
executable file with a type such as
sbin_t
. From an SELinux perspective, this means they are all
equivalent in terms of what they can and cannot do on the system.
For example, the binary executable file object at
/usr/bin/postgres
has the type
postgresql_exec_t. All of the targeted daemons have their own
*_exec_t
type for their executable
applications. In fact, the entire set of
PostgreSQL
executables such as
createlang
,
pg_dump
, and
pg_restore
have the same type,
postgresql_exec_t
, and they transition to the same domain,
postgresql_t
, upon execution.
44.7.1.1.1. Using Policy Rules to Define Type Access
The SELinux policy defines various rules which determine how each domain may access each type.
Only what is specifically allowed by the rules is permitted. By default, every operation is denied and
audited, meaning it is logged in the
$AUDIT_LOG
file. In Red Hat Enterprise Linux, this is set to
/var/
log/messages
. The policy is compiled into binary format for loading into the kernel security server,
and each time the security server makes a decision, it is cached in the AVC to optimize performance.
3
http://www.commoncriteriaportal.org/files/ppfiles/lspp.pdf
4
http://www.commoncriteriaportal.org/files/ppfiles/lspp.pdf