Memo: SELinux on Debian Etch
Install base utilities and enable SELinux
First make sure that you are using a SELinux capable kernel and filesystem. Get the targeted policy and a basic set of SELinux packages by running:
aptitude install selinux-basics selinux-policy-refpolicy-targeted
Edit /boot/grub/menu.lst and add selinux=1 to your kernel command line (by adding it to the #kopt= line and then running update-grub)
Run fixfiles relabel and reboot.
Run check-selinux-installation to check that everything has been setup correctly and to catch common SELinux problems.
SELinux runs by default in permissive mode, ie. it doesn’t do anything apart from auditing the actions, and logging them (eg. in /var/log/syslog). To really enable SELinux, you have to run setenforce 1 and edit /etc/selinux/config.
Usfeful tips
Relabel files:
# restorecon -R -v /etc /usr/sbin /var/run /var/log
Allow NFS server:
# setsebool -P nfs_export_all_rw 1
xconsole:
Remove the call to create_xconsole in /etc/init.d/sysklogd
Remove the section about xconsole from /etc/syslog.conf
Load necessary modules to confine the daemons in their own domains:
semodule -i /usr/share/selinux/refpolicy-targeted/
eg.
# semodule -l
apache 1.4.0
apm 1.3.0
avahi 1.3.0
dbus 1.3.0
gpg 1.1.0
hal 1.4.0
inetd 1.2.0
loadkeys 1.0.0
portmap 1.3.0
prelink 1.2.0
pythonsupport 0.0.1
rpc 1.3.0
rsync 1.3.0
sasl 1.3.0
screen 1.1.0
smartmon 1.1.0
ssh 1.4.0
tcpd 1.1.0
udev 1.4.0
usbmodules 1.1.0
vbetool 1.1.0
mt-daapd:
setsebool -P allow_execmod=1
execstack -c $(locate libFLAC.so.7.0.0)
execstack -c $(locate libavcodec.so.0d)
In the first line, you turn on execmod. In the 2 lines after, you disable the execstack from shared librairies.
mplayer:
execstack -c $(locate libmp3lame.so.0)
execstack -c $(locate libxvidcore.so.4)
snmpd:
setsebool -P snmpd_disable_trans=1
Links
Debian specific:
- http://wiki.debian.org/SELinux
- http://etbe.blogspot.com/2006/12/se-linux-on-debian-in-5-minutes.html
- http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=selinux;users=selinux-devel@lists.alioth.debian.org
Other:
No comments:
Post a Comment