2012 Red Hat Summit: SELinux For Mere Mortals

[@whisperjam33]

I am totally new to Linux yet your video made it extremely simple. I wish all instructors would take some lessons from you :) Thanks so much!!!

[@redhat]

Hi Randall, See Thomas's reply below. Pleas go to the Red Hat Summit website, you can find them there. Thanks for checking out the video!

[@ManvirSinghP4L]

Link to the slides: people.redhat.com/tcameron/Summit2012/SELinux/cameron_w_120_selinux_for_mere_mortals.pdf

[@Dirtbag359]

This video was a life saver. The chcon command was driving me nuts because I didn't quite understand what I was doing when I was using it. All I knew was at times there would be instructions giving me a chcon command to enter verbatim into to the terminal which is easy enough when its given to you but if I was in a situation where it wasn't laid out for me I was screwed. Now at the very least I know what types I need to be looking for when using chcon if I want a file to possess certain attributes. Not to mention when I use ls -Z I don't feel like a complete idiot. Obviously I still have a lot more to learn but a lot of the key fundamentals for SELinux clicked with this lecture. So in short many thanks for having this lecture posted on the channel.

[@nikikovacs1923]

I used to turn off SELinux on RHEL/CentOS for a few years, but this presentation really made me want to dive into it and get a grasp. Thanks a lot, Thomas Cameron!

[@ThomasCameron]

Hi Abhijit - You could use regular old permissions (DAC) to grant access to files in /proc. Then if you are still getting avc denials, use the steps I described in the video to grant privileges.

[@iandennison4716]

Would be nice to hear the questions asked by audience members (or see a transcript on screen), but very good presentation.

[@hannahs2058]

This was extremely helpful, thank you very much.

[@XSFlanger]

Thank you for comprehensive and entertaining presentation! I was also always scared about whole this MAC concept, but sometime you've got to learn and use it :)

[@ElTebe]

I like this helpful & clear presentation. @Thomas Cameron thank you!

[@KumbaIvor]

Excellent. This made SELinux so easy for me to deal with.

[@moltenaluminium]

Dear camera man, If he's pointing at / reading the screen, It probably is something you shuold want to point the camera at.

[@ThomasCameron]

Look at the Red Hat Summit web site, the slides are available there.

[@SonnetGomes]

Thank you so much for explaining it so simply. It really isnt' as confusing as it seemed to be. Thank you for simplifying the core concepts so well :-)

[@DanBowkley]

This has come a really long way since I last played with it. Mayne I won't get a headache this time! :D

[@BillyPuzaras]

This is SO GOOD that I wish I could give it a 100 thumbs up

[@ThomasCameron]

+Billy “NotFromBrooklyn” Puzaras Thank you very much, that means a lot!

[@1337flite]

One area that SE Liniux can have an impact is really time sensitive stuff. A guy I worked with ran into it with network connections for cross site RAC. Even in permissive mode - as the permissive mode is still running the checks.

[@ameyamagashe]

Simply superb! I liked the video very much

[@robertstein6847]

The presenter did an excellent job with describing each area thoroughly to ensure the simplest person can understand it and kept my attention throughout. This has been an excellent overview of SELinux and I feel much more confident tackling it in the future. Thank You Thomas. Is it possible to get the PowerPoint presentation?

[@ThomasCameron]

+Robert Stein people.redhat.com/tcameron/

[@brianredbeard]

One important thing to note: the logging location for most selinux events is no longer /var/log/messages but /var/log/audit/audit.log? Want to do a quick check? # grep AVC /var/log/audit/audit.log

[@ThomasCameron]

+Brian Redbeard pretty sure I talked about that in the slides. Good to hear from you, man!

[@gw00tw00t]

Great talk Thomas. Made me accept to get along with SELinux.

[@CTimmerman]

Does it not suffice to use Linux's built-in DAC to allow httpd to only read its own data and only write its own logs?

[@mojola2]

I wish the director would leave up the slides -- where the useful information is. Not much point in seeing the speaker.

[@flizbarg]

I had mentioned a location for slides that turned out to be for an older presentation. The slides for this one can be found using the concatentation of these path components without any spaces: rhsummit.files.wordpress. com /2012/03/ cameron_selinux_for_mere_mortals.pdf When I cut'n'paste path strings from these comments I end up with extraneous junk in them not visible in the actual comments...? It's easy to remove as each instance is typically a percent char followed by 2 hex chars.

[@redhat]

Thanks, brainst0rmVideo!

[@Caddy666]

If possible, could you guys subtitle the question? i can't hear them....

[@adefwrrea]

This was needed, thank you

[@doge-coin]

Very clear. Thank you so much sir.

[@ChrisLindbergh]

Thank you Charles Atlas!! ;)

[@achak01]

Hey Thomas!! thanks for the session. I really wouldlike t oknow one thing here. Isit really possible to read or set any modes on the /proc file ssytem so that i can grant privilege to a non root user to check the pfiles ?

[@traviseddy2386]

Can you put a link to those slides in your videos description/info? thanks

[@ThomasCameron]

+Travis Eddy people.redhat.com/tcameron/

[@gabe1232]

change xom and put com and remove the extra space for the correct link

[@rehmatali2167]

it is really good indeed ! thanks buddy

[@InAUGral]

Anyone get a copy of his presentation slides?

[@uzomanwosu]

people.redhat.com/tcameron/Summit2012/SELinux/cameron_w_120_selinux_for_mere_mortals.pdf

[@traviseddy2386]

uzoma nwosu thank you

[@shubhanshuvishwakarma4451]

Thank u so much that was really helpful 🙂

[@ablueg]

file not found

[@brainst0rmVideo]

Thanks for the video!

[@zanelatobm]

very cool, nice one!!

[@TheUser04460]

Super, very funny says Thomas. Great job!

[@nikhilji]

good stuff !

[@TheKetsa]

NSAlinux ? you sure ?

[@LemonPieLoL]

It's funny, because I use to deride anyone who was paranoid about selinux and suggest they learn the code.. but after hearing about the NSA's work with hard drive vendors and the possible inclusion of bacdoors in closed source firmware it got me thinking - wouldn't it be entirely feasible to trigger the installation, from the firmware, of a backdoor when a very specific policy violation is fired? I mean, daemons like Apache are open to the entire web.. from that perspective you could read all the code you want.. you won't find anything obvious. I really want a fully open platform - all devices.. keyboards.. the lot.

[@ThomasCameron]

If we were talking about closed source binaries, I might concur. But in this case, it's all Open Source. The code is thoroughly analyzed by Red Hat engineers and the greater Open Source community - folks who are NOT fans of the NSA. If there were any back doors, they would be found pretty quickly. Imagine your reputation if you were the security guy who found nefarious NSA code! There are a TON of folks digging through the code. It's safe.

[@LemonPieLoL]

Thomas Cameron I think you have misread my comment. Firmware in hard drives IS closed source. Your brain just went into auto pilot I think.

[@ThomasCameron]

LemonPieLoL I think you misread my response. It was to TheKetsa.

[@joeyofblades]

Camera guy please, look at the god damned slides... holyshit

[@GuitarsAndSynths]

SELinux unfortunately does not play well with Oracle!

[@machinelearningid3931]

I understand selinux now

[@chuckmccarty3536]

Camera guy.... Get a clue! WE WANT TO SEE AAALLLL OF THE SLIDES!!!!!

[@ThomasCameron]

+Chuck “FarEastRocker” McCarty people.redhat.com/tcameron/

[@ThomasCameron]

For the slides, go to people redhat com / tcameron Thanks

[@dmi3mis]

i want this t-shirt

[@aaronvalleytrees]

"so easy a windows admin could do it" hahaha

[@bla4224]

bla bla bla - one hour completely wasted. And these guys even seem to proud of this kind of bull...

[@Linkale_]

Windows >>>>>>>>>>>> this shit