To writing the actual policy for SELinux application, you can get many of the permissions your application needs by running.
First test if is installed into your Fedora distro.
I used Fedora 27 with SELinux set
Enforcing.
If your application is named my_app then use this command:
sepolgen --init /path/to/my_app
The result of this command will be this:
app.fc
my_app.sh
my_app.if
my_app_selinux.spec
my_app.te
If your application will be a rpm package, you can delete app.spec and app.sh.
The file with extension
.te is a
Type Enforcement file.
About this five files, the Linux help tells us:
Type Enforcing File NAME.te
This file can be used to define all the types rules for a particular domain.
Note: Policy generated by sepolicy generate will automatically add a permissive DOMAIN
to your te file. When you are satisfied that your policy works, you need to remove
the permissive line from the te file to run your domain in enforcing mode.
Interface File NAME.if
This file defines the interfaces for the types generated in the te file, which can
be used by other policy domains.
File Context NAME.fc
This file defines the default file context for the system, it takes the file types
created in the te file and associates file paths to the types. Tools like restorecon
and RPM will use these paths to put down labels.
RPM Spec File NAME_selinux.spec
This file is an RPM SPEC file that can be used to install the SELinux policy on to
machines and setup the labeling. The spec file also installs the interface file and
a man page describing the policy. You can use sepolicy manpage -d NAME to generate
the man page.
Shell File NAME.sh
This is a helper shell script to compile, install and fix the labeling on your test
system. It will also generate a man page based on the installed policy, and compile
and build an RPM suitable to be installed on other machines
Open the
my_app.te file will see something like this:
policy_module(my_app, 1.0.0)
########################################
#
# Declarations
#
type my_app_t;
type my_app_exec_t;
init_daemon_domain(my_app_t, my_app_exec_t)
# Please remove this once your policy works as expected.
permissive my_app_t;
########################################
#
# my_app local policy
#
allow my_app_t self:fifo_file rw_fifo_file_perms;
allow my_app_t self:unix_stream_socket create_stream_socket_perms;
domain_use_interactive_fds(my_app_t)
files_read_etc_files(my_app_t)
auth_use_nsswitch(my_app_t)
miscfiles_read_localization(my_app_t)
sysnet_dns_name_resolve(my_app_t)
The first line uses the name of the binary and will be the name of the policy and the version.
policy_module(my_app, 1.0.0)
The nest rows come with this:
type my_app_t;
type my_app_exec_t;
init_daemon_domain(my_app_t, my_app_exec_t)
- the unique type to describe this application is my_app_t.
- SELinux tells us we’ll be executing this file with my_app_exec_t.
- this program will run as a service: init_daemon_domain(my_app_t, my_app_exec_t).
The next row is about log permission errors ( but let the application continue to run).
permissive my_app_t;
The next rows show how the application use file permissions and if the application will use Unix steam.
Don't change it , you can get a google search to see more examples with this type of allow.
allow my_app_t self:fifo_file rw_fifo_file_perms;
allow my_app_t self:unix_stream_socket create_stream_socket_perms;
Abou this rows:
domain_use_interactive_fds(my_app_t)
files_read_etc_files(my_app_t)
auth_use_nsswitch(my_app_t)
miscfiles_read_localization(my_app_t)
sysnet_dns_name_resolve(my_app_t)
The
domain_use_interactive_fds and
term_use_all_terms support operations where SSH allocates a tty for the user( example the allow fifo_file supports the opposite).
The my_app want to read from /etc folder with
files_read_etc_files.
The
auth_use_nsswitch also can adds rules allowing access to NIS/YPBIND ports.
The
miscfiles_read_localization is about localization code.
To better understand this tutorial, you can create a folder in your home directory and then test it with a different application from Fedora 27.
One good example:
sepolgen --init /opt/firefox .
