Understanding and Configuring SELinux (Security Enhanced Linux)

Do you know what's -rwxr-xr-x means? Great, yet it is not enough to configure permissions on your Linux host anymore. From 2018 SELinux (Security Enhanced Linux) is turned ON by default in most distributions. While improving the security, it will also block many actions that were allowed before which may lead to hard-to-find errors.
In this video we'll learn how to configure SELinux policies for our deployment.
10:00 commands summary (for those in a rush)
------------------
Deploying Node playlist:
• Deploying Node
------------------
00:10 - what is SELinux
01:28 - check if SELinux is enabled
02:40 - SELinux permission model
06:32 - how to allow connection between nginx and node.js
07:46 - allowing nginx to read users home directories
08:13 - changing the type of static file (allowing nginx to read them)
10:00 - commands summary

[@yousifalneamy7833]

Man, you're the best. Please continue with what you're doing

[@Fir3Chi3f]

This was a good intro to SELinux from the prospective of a web developer. Thank you Juriy

[@torsion7220]

After several hours of messing with nginx configs, this finally explained and solved my problem. Thank you.

[@gianlucagiuman6132]

Finally i found your tutorial that saved my life for programming python on fedora !!!

[@Hector0]

I've been looking for days to solve a connection error, many many thanks

[@trainchen9861]

A million thanks! Every detail is soooooooo important!

[@Henqi]

Very nicely done: good info in a small enough package with useful commands!

[@eddtsoi]

love this series, I learn a lot from your video. Thank you so much

[@RodrigoSotoCastro]

Nice video, thanks!

[@yourgflikesit]

This course was amazing, it is only missing a firewall tutorial. Will you be planning on adding that?

[@shaileshpatil3733]

your video save my night....

[@unhash631]

Been using Linux for more than a year now but haven't heard about SELinux; thanks for the time for introducing us about it. Some clarifications though: Does httpd_can_network_connect only specifically allow Nginx? Does httpd_enable_homedirs always come in pair with httpd_sys_content_t?

[@raphaelkuttruf]

On LinuxMint: Mandatory Access Control os done with AppArmor

[@diegor5805]

Should I be worried about the file's user saying unconfined_u? Should I change it back to system_u? unconfined doesn't just doesn't sound good.

[@MichaelBullutKE]

Currently, I am testing SELinux on an Ubuntu 22.04.4 virtual machine & when I enable enforcing, mode the network gets turned off. Funny enough, when I enabled permissive mode, the network is restored. Am I configuring it wrong?

[@jutubjestzlem]

You should not use httpd_sys_content_t on your home dir. This may break other things. There is a separate type to use on user content.

[@josephkim4723]

I noticed that with Vultr CentOS, SELinux isn't enabled, `get enforce` outputs `Disabled` for me. I have CentOS Linux release 7.6.1810 (Core). So now I'm wondering, should I enable SELinux purposely, following Digital Ocean's guide, www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts. @Juriy, can I have the link you were referring to in 2:21?

[@JoseAlvarez-dl3hm]

I do not know if that is true now for CentOS but I get Enforcing from getenforce command in a Fedora33 in a vultr vps

[@looks-good]

Hi Juriy! My CentOS 8 getenforce = Disabled. And I can't find the link about enabling this. Could you please help? By the way I've just ruined my server with wrong instructions from another site((((

[@thiaguinhocunha]

pls pls do more on SEliux

[@sushantkoul7777]

whats in the easyio ffile

[@marciofs70]

Hi Juriy, I saw the another video from your channel (Installing and Configuring NGINX on CentOS) and thats why I am here. But I use a centos distro from my provider (vultr) and I can not enable SElinux. typing getenforce 0 or 1, does not matter.. I can not enable. Do you know how can I fix this?

[@JuriyBura]

Yes, setenforce only work when selinux is enabled and it is switching enforcing/permissive modes. If you want to enable it, you need to edit /etc/sysconfig/selinux file (it is quite well documented). After you enabled it in a file, create an empty file /.autorelabel (right in the root of the filesystem) and then reboot your system.

[@marciofs70]

Thanks Juriy.. But I figured out.. The problem is the distro of linux. I was using a minimal version.

[@josephkim4723]

@@marciofs70 I too am using Vultr, and I also get getenforce Disabled on CentOS 7 x64. How did you find out that you had a minimal version? And what did you change it to?

[@StupidusMaximusTheFirst]

SEL is way too complicated, apps change way too fast, including their dependencies, I'm not sure if it's worth the trouble. And really, it hasn't gone that far ever since it was introduced decades ago, things are just as I left them as far as I remember. Nowadays you have containers and VMs, there are no ways to escape out of them, and it's much easier and safer imho. In the past, even this kind of thing was difficult to set up, a custom chroot was a lot of work. Now it's easy, it's not efficient, you drop a whole unnecessary minimal OS in that docker, but it's easy. And people managed to make minimal versions of their distros somewhat better than what they used to be.

[@chrissze]

TROUBLESHOOT SELINUX 1.Change SELinux to permissive mode, so that it only do logging, but not enforcing. # setenforce 0 2.Check the log, by keyword search on the log: # cat /var/log/messages | grep "SELinux is preventing" These are the errors if it is enforcing, there is a command like run: # sealert -l 2bea6d06-41ed-4164-b30e-488865696951 We can use it to check the details by running the above command. Pay attention to the timestamp too. 3. Run “sealert” command to get a suggested solution After running “sealert” command, there will be a solution, it usually ask the user to run several terminal commands like these: # ausearch -c 'gunicorn' --raw | audit2allow -M my-gunicorn # semodule -X 300 -i my-gunicorn.pp 4. Create a folder for future reference before running the suggested solution, because solution command might create files like my-gunicorn.pp my-gunicorn.te # mkdir ~/Documents/selinuxsolution 5. Run the suggested command in sealert # ausearch -c 'gunicorn' --raw | audit2allow -M my-gunicorn # semodule -X 300 -i my-gunicorn.pp 6. Fix "SELinux is preventing" problems one by one, assuming now SELinux is in permissive mode, make sure the web service is running fine, then turn on SELinux: Edit /etc/selinux/config OR /etc/sysconfig/selinux Then run this command # setenfore 1 The Web service should still be running after turning on SELinux

[@jutubjestzlem]

Chris Sze This is a bad advice. One should analyze the cause of denial instead of just blindly allowing whatever has caused the denial.