1
00:00:00,360 --> 00:00:01,890
Security Enhanced Linux,

2
00:00:01,890 --> 00:00:05,370
also known as SELinux is the default context based

3
00:00:05,370 --> 00:00:08,189
permission scheme provided with CentOS OS

4
00:00:08,189 --> 00:00:10,230
and Red Hat Enterprise Linux.

5
00:00:10,230 --> 00:00:12,540
This program was actually developed by NSA

6
00:00:12,540 --> 00:00:16,290
to provide additional file system and network security.

7
00:00:16,290 --> 00:00:17,370
In this demonstration,

8
00:00:17,370 --> 00:00:19,920
we're going to walk through how to define security context

9
00:00:19,920 --> 00:00:21,750
on our web files and directories

10
00:00:21,750 --> 00:00:24,420
to ensure the web server is operational.

11
00:00:24,420 --> 00:00:26,070
First thing we want to do is go ahead and just check

12
00:00:26,070 --> 00:00:31,070
the status of the SELinux and we see it's currently enabled

13
00:00:31,590 --> 00:00:33,120
and the current mode is enforcing.

14
00:00:33,120 --> 00:00:34,230
Those are the key parameters

15
00:00:34,230 --> 00:00:36,150
that you're going to be looking at.

16
00:00:36,150 --> 00:00:37,800
Next thing we're going to do is we're just going to create

17
00:00:37,800 --> 00:00:40,233
a directory to hold the web server files.

18
00:00:41,329 --> 00:00:43,076
Going to do sudo.

19
00:00:43,076 --> 00:00:44,526
We're going to make a directory.

20
00:00:46,170 --> 00:00:47,160
We're just going to name it,

21
00:00:47,160 --> 00:00:48,453
well let's do test web.

22
00:00:53,130 --> 00:00:56,643
Next we're going to create a file in this.

23
00:01:00,960 --> 00:01:03,503
Now let's just make sure that the file was stored correctly.

24
00:01:08,580 --> 00:01:09,663
Okay. We see that.

25
00:01:10,590 --> 00:01:11,423
All right.

26
00:01:11,423 --> 00:01:13,080
We just want to make sure next that

27
00:01:13,080 --> 00:01:16,110
that file has read privileges, which it does to all users.

28
00:01:16,110 --> 00:01:18,120
Remember that's that last field

29
00:01:18,120 --> 00:01:19,710
but we also need to check the directory.

30
00:01:19,710 --> 00:01:21,873
So let's list out the directory privileges.

31
00:01:22,770 --> 00:01:23,603
Okay.

32
00:01:23,603 --> 00:01:25,260
We just verifying that all users,

33
00:01:25,260 --> 00:01:26,400
which is the last field,

34
00:01:26,400 --> 00:01:29,433
have read and execute privileges on this directory.

35
00:01:30,270 --> 00:01:31,470
Next thing we're going to do

36
00:01:31,470 --> 00:01:33,780
is we're going to configure the Apache settings

37
00:01:33,780 --> 00:01:36,120
to use the new path in that document.

38
00:01:36,120 --> 00:01:39,720
Okay. So we're going to open the configuration file.

39
00:01:39,720 --> 00:01:40,553
So, sudo.

40
00:01:44,430 --> 00:01:46,140
And what we're going to be looking for is the document route.

41
00:01:46,140 --> 00:01:47,190
It's already highlighted there

42
00:01:47,190 --> 00:01:49,890
but just in case it was hard for someone to find,

43
00:01:49,890 --> 00:01:52,080
we can just do the forward slash,

44
00:01:52,080 --> 00:01:55,893
a new document route just to get to where we need.

45
00:02:00,240 --> 00:02:01,170
Okay.

46
00:02:01,170 --> 00:02:05,910
Now we just need to change this insertation here

47
00:02:05,910 --> 00:02:09,270
to the new directory that we just created

48
00:02:09,270 --> 00:02:10,350
for our web server files.

49
00:02:10,350 --> 00:02:14,013
So we go to insert mode and do test web.

50
00:02:15,840 --> 00:02:16,920
Here.

51
00:02:16,920 --> 00:02:20,670
And one more thing we want to do is change this directory tag.

52
00:02:20,670 --> 00:02:23,940
So what this directory tag does is creates a container

53
00:02:23,940 --> 00:02:26,550
to enclose a group of configuration directives

54
00:02:26,550 --> 00:02:28,770
to apply only to a specific directory,

55
00:02:28,770 --> 00:02:31,920
because typically the route is very restrictive.

56
00:02:31,920 --> 00:02:34,050
So we had to add other directives

57
00:02:34,050 --> 00:02:35,730
to make it a little less restrictive

58
00:02:35,730 --> 00:02:38,943
so we can provide for other access to other users.

59
00:02:40,230 --> 00:02:41,380
We'll change that here.

60
00:02:46,118 --> 00:02:46,951
Okay.

61
00:02:48,420 --> 00:02:50,780
And again, just to clarify the document route

62
00:02:50,780 --> 00:02:54,570
is going to be the top level directory that once a user

63
00:02:54,570 --> 00:02:56,790
hits the website that's going to be the first directory

64
00:02:56,790 --> 00:02:58,340
that they come in contact with.

65
00:02:59,310 --> 00:03:00,143
All right.

66
00:03:01,530 --> 00:03:03,180
That looks good.

67
00:03:03,180 --> 00:03:06,060
Last thing we need to do is actually restart Apache.

68
00:03:06,060 --> 00:03:07,803
So we do system control.

69
00:03:09,270 --> 00:03:10,103
Restart.

70
00:03:14,520 --> 00:03:16,140
All right.

71
00:03:16,140 --> 00:03:19,920
Now let's try to actually access this webpage.

72
00:03:19,920 --> 00:03:22,620
Now we should get an error because SELinux

73
00:03:22,620 --> 00:03:25,540
is enforcing these policies

74
00:03:26,880 --> 00:03:28,733
and we shouldn't be able to get to it.

75
00:03:39,900 --> 00:03:40,733
All right.

76
00:03:41,730 --> 00:03:44,100
This is the response that we should receive

77
00:03:44,100 --> 00:03:46,740
because we haven't lowered the context permission

78
00:03:46,740 --> 00:03:49,470
to make access available for everyone.

79
00:03:49,470 --> 00:03:51,000
Now we see we have this alert.

80
00:03:51,000 --> 00:03:53,100
Let's click this and see what it tells us.

81
00:03:54,720 --> 00:03:56,570
Okay, we want to click this right here.

82
00:03:59,280 --> 00:04:00,513
Let's troubleshoot this.

83
00:04:01,380 --> 00:04:02,370
Okay.

84
00:04:02,370 --> 00:04:03,203
We're going to click here.

85
00:04:03,203 --> 00:04:04,590
Let's read this.

86
00:04:04,590 --> 00:04:06,060
It says you need to change the label

87
00:04:06,060 --> 00:04:09,190
of the var/testweb/test.html

88
00:04:10,620 --> 00:04:12,870
se manage fcontext.

89
00:04:12,870 --> 00:04:15,540
So it gives us a lot of detailed information

90
00:04:15,540 --> 00:04:17,403
of how to fix this problem.

91
00:04:18,570 --> 00:04:19,403
All right.

92
00:04:22,019 --> 00:04:26,700
Now we don't need to go through all this on this example

93
00:04:26,700 --> 00:04:29,790
but you see it's very descriptive on what you need to do

94
00:04:29,790 --> 00:04:31,190
to get the correct solution.

95
00:04:32,490 --> 00:04:33,450
But we're going to fix it ourselves.

96
00:04:33,450 --> 00:04:35,610
Let's get out of here real quick.

97
00:04:35,610 --> 00:04:37,110
So what we're about to do now

98
00:04:37,110 --> 00:04:40,810
is we're going to look at the previous context and see

99
00:04:42,000 --> 00:04:45,303
what that file had for the www, the default one.

100
00:04:47,610 --> 00:04:49,590
Now basically what we're going to do at this point

101
00:04:49,590 --> 00:04:52,710
is just copy that previous file permissions

102
00:04:52,710 --> 00:04:55,680
and apply it to our new directory that we just created

103
00:04:55,680 --> 00:04:57,003
in the var test web.

104
00:04:57,870 --> 00:04:59,250
And if you look at the fields,

105
00:04:59,250 --> 00:05:02,280
the first field is set for the user context.

106
00:05:02,280 --> 00:05:05,580
The next field's going to be for the object role,

107
00:05:05,580 --> 00:05:07,950
and the last context is going to be for the type.

108
00:05:07,950 --> 00:05:11,793
And again, these are all defined SELinux context.

109
00:05:12,630 --> 00:05:15,300
The user context defines what the users can access

110
00:05:15,300 --> 00:05:16,980
on that object.

111
00:05:16,980 --> 00:05:20,700
The role context defines what roles can access the object.

112
00:05:20,700 --> 00:05:23,490
And the type context is the label portion

113
00:05:23,490 --> 00:05:25,953
of the mandatory access control.

114
00:05:26,850 --> 00:05:27,683
All right.

115
00:05:27,683 --> 00:05:28,516
So we know that

116
00:05:29,603 --> 00:05:30,803
the appropriate type should be httpd_assist_content_t.

117
00:05:34,590 --> 00:05:37,560
Now we're going to apply that to our directory,

118
00:05:37,560 --> 00:05:40,173
but let's just look and see what we have currently.

119
00:05:43,290 --> 00:05:44,295
Okay.

120
00:05:44,295 --> 00:05:47,850
So the var_t is the default context

121
00:05:47,850 --> 00:05:50,190
that was passed down from the var folder

122
00:05:50,190 --> 00:05:52,530
which is our parent directory.

123
00:05:52,530 --> 00:05:54,660
So we're going to need to change this.

124
00:05:54,660 --> 00:05:55,493
All right.

125
00:05:55,493 --> 00:05:56,850
So let's go ahead and apply the appropriate context

126
00:05:56,850 --> 00:05:57,900
to the new directory.

127
00:05:59,610 --> 00:06:00,443
We're going to sudo

128
00:06:01,590 --> 00:06:02,770
se manage

129
00:06:05,610 --> 00:06:06,443
fcontext.

130
00:06:08,447 --> 00:06:09,990
So that's the context we're going to use.

131
00:06:09,990 --> 00:06:11,760
We're going to add

132
00:06:11,760 --> 00:06:15,840
a particular context our specific type

133
00:06:15,840 --> 00:06:17,550
which is going to be a file.

134
00:06:17,550 --> 00:06:18,850
So it's going to be the httpd

135
00:06:22,289 --> 00:06:27,289
sys_content_t that's going to be the context.

136
00:06:27,960 --> 00:06:31,900
We're going to add it to the var test web

137
00:06:35,340 --> 00:06:39,130
and we're going to use the regular expressions to

138
00:06:40,080 --> 00:06:41,730
just let the system know

139
00:06:41,730 --> 00:06:44,613
we want to apply this to all the subdirectories as well.

140
00:06:53,340 --> 00:06:55,140
Looks like that it went through successfully.

141
00:06:55,140 --> 00:06:57,090
Let's go ahead and check this context.

142
00:06:57,090 --> 00:06:59,610
Now it shouldn't change because again

143
00:06:59,610 --> 00:07:03,123
we're going to need to restart the context or reset it.

144
00:07:06,210 --> 00:07:08,820
Okay. We see it sealed the var_t.

145
00:07:08,820 --> 00:07:11,013
Now we're going to restore this context.

146
00:07:12,300 --> 00:07:14,400
Pretty much what it makes the system do

147
00:07:14,400 --> 00:07:17,313
is check the configuration file for the context.

148
00:07:26,430 --> 00:07:28,053
Okay. Now let's check it now.

149
00:07:32,340 --> 00:07:34,830
Looks like it successfully went through.

150
00:07:34,830 --> 00:07:35,663
Last but not least,

151
00:07:35,663 --> 00:07:37,440
we'll go ahead and check this again.

152
00:07:37,440 --> 00:07:39,440
Now let's see if we have access to this.

153
00:07:47,280 --> 00:07:48,630
Voila.

154
00:07:48,630 --> 00:07:51,930
So we walked through how to configure some context files

155
00:07:51,930 --> 00:07:55,020
in order to allow the web server to give access

156
00:07:55,020 --> 00:07:57,330
to users who are trying to access the files

157
00:07:57,330 --> 00:07:58,680
through a web browser.

158
00:07:58,680 --> 00:07:59,513
Thank you.

159
00:07:59,513 --> 00:08:00,750
And I'll see you in the next one.