1 00:00:00,090 --> 00:00:03,420 In this lesson, we're going to discuss SELinux. 2 00:00:03,420 --> 00:00:05,070 Now, in order to further mitigate the risk 3 00:00:05,070 --> 00:00:07,560 of a security breach, several Linux distributions 4 00:00:07,560 --> 00:00:08,940 provide an additional layer of security 5 00:00:08,940 --> 00:00:11,370 on top of the original operating system. 6 00:00:11,370 --> 00:00:13,620 Now, one of the best ways to stop a data breach 7 00:00:13,620 --> 00:00:15,870 is to restrict the ability of granting access 8 00:00:15,870 --> 00:00:17,160 or denying somebody's access 9 00:00:17,160 --> 00:00:20,310 to a given resource object within your file system. 10 00:00:20,310 --> 00:00:21,240 And this is where the idea 11 00:00:21,240 --> 00:00:23,760 of Mandatory Access Control comes into play 12 00:00:23,760 --> 00:00:26,580 and this is known as MAC, M-A-C. 13 00:00:26,580 --> 00:00:29,370 Now, Mandatory Access Control is a system-enforced 14 00:00:29,370 --> 00:00:31,620 access control mechanism that's based on 15 00:00:31,620 --> 00:00:34,200 subject clearance and the object labels. 16 00:00:34,200 --> 00:00:35,940 In this lesson, we're going to discuss 17 00:00:35,940 --> 00:00:39,120 context-based permissions and security related technologies 18 00:00:39,120 --> 00:00:42,210 as a security enhanced Linux, classified as MAC 19 00:00:42,210 --> 00:00:44,370 or Mandatory Access Control systems, 20 00:00:44,370 --> 00:00:46,950 to create those mechanisms on how to restrict access 21 00:00:46,950 --> 00:00:50,610 to system processes into the files, directories, networks, 22 00:00:50,610 --> 00:00:53,040 ports, and other things like that. 23 00:00:53,040 --> 00:00:56,040 Now, context-based permissions refer to permission schemes 24 00:00:56,040 --> 00:00:58,830 that are defined by various properties for a given file 25 00:00:58,830 --> 00:01:01,890 or process, and it uses those properties together, 26 00:01:01,890 --> 00:01:03,930 rather than in isolation to determine 27 00:01:03,930 --> 00:01:07,140 whether to grant or deny access to a given user. 28 00:01:07,140 --> 00:01:09,780 Now, in Linux, there are two main context-based 29 00:01:09,780 --> 00:01:11,520 permission schemes that are available, 30 00:01:11,520 --> 00:01:14,370 namely SELinux and AppArmor. 31 00:01:14,370 --> 00:01:16,800 And both of these context-based permission schemes 32 00:01:16,800 --> 00:01:18,960 leverage MAC to do their work. 33 00:01:18,960 --> 00:01:21,780 Now, this differs from the default scheme inside of Linux, 34 00:01:21,780 --> 00:01:25,200 which is known as DAC or Discretionary Access Control. 35 00:01:25,200 --> 00:01:27,960 In DAC, each object has a list of entities 36 00:01:27,960 --> 00:01:30,600 that are allowed to access it, whether these are systems, 37 00:01:30,600 --> 00:01:32,760 processes, files, or users, 38 00:01:32,760 --> 00:01:34,650 and the person who controls that 39 00:01:34,650 --> 00:01:36,360 is actually the object owner. 40 00:01:36,360 --> 00:01:37,980 They can make those changes directly 41 00:01:37,980 --> 00:01:40,560 using things like change own (chown) or change mod (chmod), 42 00:01:40,560 --> 00:01:42,150 depending on whether you want to change ownership 43 00:01:42,150 --> 00:01:43,770 or permissions, and you can do that 44 00:01:43,770 --> 00:01:45,600 in a discretionary manner. 45 00:01:45,600 --> 00:01:48,540 Now, SELinux, on the other hand, doesn't allow DAC, 46 00:01:48,540 --> 00:01:51,450 and instead it relies on MAC to do its permissions 47 00:01:51,450 --> 00:01:52,980 and access control. 48 00:01:52,980 --> 00:01:55,980 SELinux was created by the National Security Agency, 49 00:01:55,980 --> 00:01:57,750 known as the NSA. 50 00:01:57,750 --> 00:02:01,230 SELinux is the default context-based permission scheme 51 00:02:01,230 --> 00:02:03,330 that's included inside of CentOS 52 00:02:03,330 --> 00:02:05,490 and Red Hat Enterprise Linux. 53 00:02:05,490 --> 00:02:08,009 By using SELinux, we have a way to provide 54 00:02:08,009 --> 00:02:10,500 additional file system and network security 55 00:02:10,500 --> 00:02:12,960 so that unauthorized processes cannot access 56 00:02:12,960 --> 00:02:16,320 or tamper with our data, bypass our security mechanisms, 57 00:02:16,320 --> 00:02:18,060 violate our security policies 58 00:02:18,060 --> 00:02:20,790 or execute untrustworthy programs. 59 00:02:20,790 --> 00:02:24,900 SELinux is used to enforce MAC on processes and resources 60 00:02:24,900 --> 00:02:26,940 and enables information to be classified 61 00:02:26,940 --> 00:02:29,340 and protected, based on its confidentiality 62 00:02:29,340 --> 00:02:31,200 and integrity requirements. 63 00:02:31,200 --> 00:02:33,570 This helps us mitigate the damage that could be caused 64 00:02:33,570 --> 00:02:36,180 by information getting into the hands of a malicious user 65 00:02:36,180 --> 00:02:38,130 or malicious application. 66 00:02:38,130 --> 00:02:40,770 Now, SELinux defines three main contexts 67 00:02:40,770 --> 00:02:42,840 for each file and process. 68 00:02:42,840 --> 00:02:45,930 These are the User, the Role, and the Type. 69 00:02:45,930 --> 00:02:49,800 The User context defines what users can access an object. 70 00:02:49,800 --> 00:02:52,320 Different distributions provide different users, 71 00:02:52,320 --> 00:02:55,920 but the most common ones include Unconfined_u, 72 00:02:55,920 --> 00:02:57,360 which pertains to all users. 73 00:02:57,360 --> 00:03:01,260 User_u, which pertains to unprivileged users. 74 00:03:01,260 --> 00:03:05,220 Sysadmin_u, which pertains to system administrators, 75 00:03:05,220 --> 00:03:07,890 and Root, which pertains to the Root user. 76 00:03:07,890 --> 00:03:10,170 The Role context is our second area, 77 00:03:10,170 --> 00:03:13,290 and this defines what roles can access a given object. 78 00:03:13,290 --> 00:03:16,890 Now, SELinux users are authorized to be in a certain role, 79 00:03:16,890 --> 00:03:19,110 and those roles are typically used to permit 80 00:03:19,110 --> 00:03:21,600 or deny access to the given domain 81 00:03:21,600 --> 00:03:24,390 or the given resources and processes. 82 00:03:24,390 --> 00:03:26,793 To control this, there's a role called object_r, 83 00:03:27,780 --> 00:03:30,360 and this applies to your files and directories. 84 00:03:30,360 --> 00:03:33,840 Now, the third context we have is known as the Type context. 85 00:03:33,840 --> 00:03:36,480 The Type context is the label portion of MAC, 86 00:03:36,480 --> 00:03:38,400 and it's the most important context 87 00:03:38,400 --> 00:03:41,640 for this fine grained access control that we want to achieve. 88 00:03:41,640 --> 00:03:44,160 By using this type, it's a way of us grouping 89 00:03:44,160 --> 00:03:45,930 objects together that have similar 90 00:03:45,930 --> 00:03:48,600 security requirements or characteristics. 91 00:03:48,600 --> 00:03:50,460 Now, another feature of SELinux 92 00:03:50,460 --> 00:03:53,220 that's considered optional, is a fourth context, 93 00:03:53,220 --> 00:03:55,020 and this is called a Level. 94 00:03:55,020 --> 00:03:57,660 This Level is used to describe the sensitivity level 95 00:03:57,660 --> 00:04:00,660 of a given file, directory, or process. 96 00:04:00,660 --> 00:04:02,550 When we use levels, we call this 97 00:04:02,550 --> 00:04:04,800 a multi-level security context, 98 00:04:04,800 --> 00:04:06,930 and it enables you to further fine tune 99 00:04:06,930 --> 00:04:10,290 and constrain access even when the main three contexts 100 00:04:10,290 --> 00:04:12,570 are being fulfilled because this fourth one 101 00:04:12,570 --> 00:04:14,640 of this level may not be. 102 00:04:14,640 --> 00:04:17,220 Now, SELinux also has three different modes 103 00:04:17,220 --> 00:04:18,390 that we need to cover. 104 00:04:18,390 --> 00:04:21,779 These are called Disabled, Enforcing, and Permissive. 105 00:04:21,779 --> 00:04:25,290 Now, in a disabled mode, SELinux is essentially turned off, 106 00:04:25,290 --> 00:04:27,330 and so MAC is not going to be implemented, 107 00:04:27,330 --> 00:04:30,510 and instead we're going to rely on the default DAC method 108 00:04:30,510 --> 00:04:32,340 inside the file system. 109 00:04:32,340 --> 00:04:34,320 Now, when we're using enforcing mode, 110 00:04:34,320 --> 00:04:37,560 all the SELinux security policies are being enforced. 111 00:04:37,560 --> 00:04:40,020 Therefore, the processes cannot violate 112 00:04:40,020 --> 00:04:42,330 any security policies because we have them, 113 00:04:42,330 --> 00:04:44,130 and they're being enforced. 114 00:04:44,130 --> 00:04:46,650 The third one we have is known as permissive mode. 115 00:04:46,650 --> 00:04:49,350 Now, in permissive mode, SELinux is enabled, 116 00:04:49,350 --> 00:04:52,320 but the security policies are not enforced, 117 00:04:52,320 --> 00:04:54,540 and this means that processes can bypass 118 00:04:54,540 --> 00:04:56,280 the security policies. 119 00:04:56,280 --> 00:04:58,800 Now, SELinux policy is going to be used to describe 120 00:04:58,800 --> 00:05:01,110 the access permissions for all of your users, 121 00:05:01,110 --> 00:05:03,270 programs, processes, files, 122 00:05:03,270 --> 00:05:05,010 and devices that are going to be used 123 00:05:05,010 --> 00:05:07,530 and acted upon by the operating system. 124 00:05:07,530 --> 00:05:10,500 Now, SELinux can implement two different types of policies. 125 00:05:10,500 --> 00:05:12,870 These are known as Targeted or Strict. 126 00:05:12,870 --> 00:05:16,080 Now, the targeted policy is the default SELinux policy 127 00:05:16,080 --> 00:05:18,960 that's used in Red Hat Linux and CentOS. 128 00:05:18,960 --> 00:05:20,940 When we're using targeted policies, 129 00:05:20,940 --> 00:05:22,320 processes that are targeted 130 00:05:22,320 --> 00:05:24,480 are going to run in a confined domain. 131 00:05:24,480 --> 00:05:26,820 And the processes that are not targeted will run 132 00:05:26,820 --> 00:05:28,740 in an unconfined domain. 133 00:05:28,740 --> 00:05:32,220 A strict policy is really the opposite of a targeted policy, 134 00:05:32,220 --> 00:05:33,690 and this means that every subject 135 00:05:33,690 --> 00:05:35,940 and object in that system is enforced 136 00:05:35,940 --> 00:05:37,950 to operate on the MAC method. 137 00:05:37,950 --> 00:05:39,810 So when you think about targeted, 138 00:05:39,810 --> 00:05:42,630 this only applies to certain things on your operating system 139 00:05:42,630 --> 00:05:45,300 that you really want higher levels of protection for. 140 00:05:45,300 --> 00:05:47,910 If you go ahead and use the strict policy, 141 00:05:47,910 --> 00:05:51,030 it's going to enforce MAC on everything on your system. 142 00:05:51,030 --> 00:05:52,920 This is really complicated to set up 143 00:05:52,920 --> 00:05:55,260 if you want to use this strict policy 144 00:05:55,260 --> 00:05:56,880 because you have to go and look at everything 145 00:05:56,880 --> 00:05:58,680 on the system, and what could be broken 146 00:05:58,680 --> 00:06:01,110 by not having the proper access rights. 147 00:06:01,110 --> 00:06:03,960 Now, once SELinux is enforced on a system, 148 00:06:03,960 --> 00:06:05,580 there's going to be violation messages 149 00:06:05,580 --> 00:06:08,010 that are going to be captured as part of an audit log 150 00:06:08,010 --> 00:06:10,560 for you to be able to see what things people are doing 151 00:06:10,560 --> 00:06:12,120 that aren't inside of your policies 152 00:06:12,120 --> 00:06:13,440 that you're not allowing. 153 00:06:13,440 --> 00:06:14,850 Now, these violations can occur 154 00:06:14,850 --> 00:06:16,860 because somebody is trying to access an object 155 00:06:16,860 --> 00:06:19,020 or a file they don't have access to, 156 00:06:19,020 --> 00:06:20,910 or there's an action that goes against 157 00:06:20,910 --> 00:06:23,310 an existing policy and it's being blocked. 158 00:06:23,310 --> 00:06:25,980 When a system is first put under SELinux, 159 00:06:25,980 --> 00:06:28,560 it's possible to get a lot of false violations 160 00:06:28,560 --> 00:06:30,420 because your policies have to be tweaked 161 00:06:30,420 --> 00:06:32,640 and configured and fine tuned. 162 00:06:32,640 --> 00:06:35,790 Remember, SELinux is only as strong as the restrictive 163 00:06:35,790 --> 00:06:37,380 profiles that you're creating. 164 00:06:37,380 --> 00:06:39,450 So if you create good restrictive profiles 165 00:06:39,450 --> 00:06:41,790 and you harden your applications, this can prevent 166 00:06:41,790 --> 00:06:44,790 a lot of malicious attacks against your enterprise networks.