Talk about SELinux on GSE Linux/Security
by Sven Vermeulen, post on Tue 25 March 2014On today's GSE Linux / GSE Security meeting (in cooperation with IMUG) I gave a small (30 minutes) presentation about what SELinux is. The slides are online and cover two aspects of SELinux: some of its design principles, and then a set of features provided by SELinux. The talk is directed …
Hidden symbols and dynamic linking
by Sven Vermeulen, post on Mon 24 March 2014A few weeks ago, we introduced an error in the (\~arch) libselinux
ebuild which caused the following stacktrace to occur every time the
semanage command was invoked:
~ # semanage
Traceback (most recent call last):
File "/usr/lib/python-exec/python2.7/semanage", line 27, in
import seobject
File "/usr/lib64/python2.7 …Switching context depending on user code-wise
by Sven Vermeulen, post on Sun 12 January 2014I blogged about how SELinux decides what the context should be for a particular Linux user; how it checks the default context(s) and tells the SELinux-aware application on what the new context should be. Let's look into the C code that does so, and how an application should behave …
How does foo_t get this privilege?
by Sven Vermeulen, post on Sun 05 January 2014Today a question was raised how the unprivileged user domain user_t
was allowed to write to cgroup_t files. There is nothing obvious about
that in the roles/unprivuser.te file, so what gives?
I used a simple script (which I've been using for a while already) called seshowtree which presents …
Oh it is cron again...
by Sven Vermeulen, post on Fri 03 January 2014Today I was pointed to the following error:
test fcron[6722]: fcron[6722] 3.1.2 started
test fcron[6722]: Cannot bind socket to '/var/run/fcron.fifo': Permission denied
test fcron[6722]: "at" reboot jobs will only be run at computer's startup.
test fcron[6722]: updating configuration from …Private key handling and SELinux protection
by Sven Vermeulen, post on Thu 02 January 2014In this post I'll give some insight in a possible SELinux policy for a script I wrote.
The script is a certificate authority handling script, in which I can generate a private key (and certificate assigned to it), sign the certificate either by itself (for the root CA key) or …
Limiting file access with SELinux alone?
by Sven Vermeulen, post on Tue 31 December 2013While writing a small script to handle simple certificate authority activities using OpenSSL, I considered how to properly protect the files that OpenSSL uses for these activities. As you are probably aware, a system that hosts the necessary files for CA activities (like signing certificate requests) should be very secure …
Gentoo SELinux policy release script
by Sven Vermeulen, post on Wed 11 December 2013A few months ago, I wrote a small script that aids in the creation of
new SELinux policy packages. The script is on the
repository
itself, in the gentoo/ subdirectory, and is called
release-prepare.sh.
The reason for the script is that there are a number of steps to perform …
The mix of libffi with other changes
by Sven Vermeulen, post on Sun 03 November 2013I once again came across libffi. Not only does the libffi approach fight with SELinux alone, it also triggers the TPE (Trusted Path Execution) protections in grSecurity. And when I tried to reinstall Portage, Portage seemed to create some sort of runtime environment in a temporary directory as well, and …
It has finally arrived: SELinux System Administration
by Sven Vermeulen, post on Fri 27 September 2013Almost everyone has it - either physical or in their heads: a list of things you want to do or achieve before you... well, stop existing. Mine still has numerous things on it (I should get on it, I know) but one of the items on that list has recently been …