View source for SELinux

== What Is This? ==

 Security-enhanced Linux  (SELinux) is an implementation of a mandatory access control mechanism.This
 mechanism is in the Linux kernel, checking for allowed operations after standard Linux discretionary
 access controls are checked.
 

For more information check the [http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/ SELinux Guide] provided by [[RedHat]].

== Simple ==

This cargo-culted command from a Rails tutorial worked for me under RHEL 4:

 chcon -Rv user_u:object_r:httpd_user_content_t /opt/rt3/var/

The above was all that was required to get RT 3.8 running under [[SELinux]] for me, until the machine became its own (primary, and no longer relaying) mail server. At that point RT began trying to exec sendmail, which in my config was a link since I was running postfix. Notifications went undelivered and messages showed:

 Nov  8 18:48:47 rt kernel: audit(1226188127.916:114): avc:  denied  { read } for  pid=10271 comm="httpd.worker" name="sendmail" dev=dm-0 ino=4464227 scontext=user_u:system_r:httpd_t tcontext=user_u:object_r:sbin_t tclass=lnk_file

My solution was to hardlink /usr/sbin/sendmail.postfix to /usr/sbin/sendmail

Under Scientific Linux release 6.2 (Carbon) running rt4, the chcon command needed another SELinux context:
 chcon -Rv user_u:object_r:httpd_user_content_t:s0 /opt/rt4/var/

== Thorough ==

start of information regarding creating a selinux policy for FC4 and RT

 cd /etc/selinux/targeted/src/policy
 vi domains/misc/local.te
 

add...

 allow httpd_t httpd_log_t:dir create;
 allow httpd_t httpd_tmp_t:sock_file { create setattr unlink write };
 allow httpd_t httpd_log_t:sock_file { create setattr unlink write };
 

then

 make load
 

use audit2allow to convert the stuff from dmesg or /var/log/messages to that format.

also need to figure out how to set the context of files, because the stuff in $RT/var needs to be writable by the httpd_t process.

Here are my changes for running RT 3.4.5 under FC4 and SE Linux. I have rt installed in /srv/rt3 and mysql in /srv/mysql:

local.te:

 allow httpd_t httpd_sys_script_t:process { noatsecure rlimitinh siginh };
 allow httpd_t nscd_var_run_t:dir search;
 
 allow httpd_sys_script_t devlog_t:sock_file write;
 allow httpd_sys_script_t httpd_log_t:file ioctl;
 allow httpd_sys_script_t httpd_sys_script_exec_t:dir read;
 allow httpd_sys_script_t httpd_t:unix_stream_socket { accept getattr ioctl shutdown read write };
 allow httpd_sys_script_t mail_spool_t:dir search;
 allow httpd_sys_script_t mqueue_spool_t:file read;
 allow httpd_sys_script_t mysqld_db_t:lnk_file read;
 allow httpd_sys_script_t nscd_var_run_t:dir search;
 allow httpd_sys_script_t self:unix_dgram_socket { create connect ioctl write };
 allow httpd_sys_script_t syslogd_t:unix_dgram_socket sendto;
 allow httpd_sys_script_t system_mail_t:process { noatsecure rlimitinh siginh };
 allow httpd_sys_script_t var_log_t:file { append ioctl };
 
 allow system_mail_t httpd_log_t:file { append getattr };
 allow system_mail_t httpd_sys_script_t:unix_stream_socket { read write };
 allow system_mail_t httpd_t:unix_stream_socket { read write };
 allow system_mail_t nscd_var_run_t:dir search;
 
 
 

local.fc:

 /srv                            system_u:object_r:root_t
 /srv/mysql(/.*)?            system_u:object_r:mysqld_db_t
 /srv/mysql/mysql\.sock -s   system_u:object_r:mysqld_var_run_t
 
 /srv/rt3                                system_u:object_r:httpd_sys_content_t
 /srv/rt3/bin(/.*)?          system_u:object_r:httpd_sys_script_exec_t
 /srv/rt3/etc(/.*)?                              system_u:object_r:httpd_sys_content_t
 /srv/rt3/lib(/.*)?          system_u:object_r:httpd_sys_content_t
 /srv/rt3/local(/.*)?                    system_u:object_r:httpd_sys_content_t
 /srv/rt3/sbin                           root:object_r:default_t
 /srv/rt3/share(/.*)?        system_u:object_r:httpd_sys_content_t
 /srv/rt3/var                            system_u:object_r:httpd_sys_content_t
 /srv/rt3/var/mason_data(/.*)?   system_u:object_r:httpd_sys_content_t

== See also ==

The [[PostQuestionsHere]] page for some [[SELinux]] answers.