linuxexpert-practice-labs/labs/lpic-3-303/333-2-mandatory-access-control

LPIC-3 333.2: Mandatory access control

SELinux on a web server: a non-standard port and directory, the trouble with mv, a boolean, a permissive domain, a policy module, and a confined user.

Before you start

SELinux must be enforcing. The lab creates the user confined (password Lab-Pass-1) for task 5. Work as root; keep the policy module files of task 4 in /root/selinux.

Tasks

1. Install Apache (httpd), policycoreutils-python-utils and setools-console. Make Apache serve /srv/web on port 8089, with an index.html that says hello from /srv/web, starting at boot, with SELinux enforcing. Fix each denial the narrow way: label the one port, and add a file-context rule for /srv/web that survives restorecon.
2. Create a page moved.html that says moved page in your home directory and mv it into /srv/web. See it fail and why, then fix its label so that Apache serves it.
3. Put a CGI script /var/www/cgi-bin/lab.sh that prints CGI running as and its SELinux context (id -Z), and make it work at http://127.0.0.1/cgi-bin/lab.sh. Turn the httpd_enable_cgi boolean off for a moment and see it fail, then leave it on.
4. Make /srv/web/secret.txt with the type admin_home_t and see that Apache can't read it. Make httpd_t a permissive domain, fetch it again, and build a policy module labweb from the logged denials with audit2allow in /root/selinux. Install it, fetch the file, then remove the module and the permissive domain again, so that the file is refused once more.
5. Map confined to the SELinux user user_u, and log in as confined (with a key, over SSH) to see the context the session gets.

Hints

• sestatus, id -Z, ls -Z, ps -eZ; ausearch -m AVC -ts recent, audit2why. semanage port -a -t http_port_t -p tcp 8089; semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?", restorecon -Rv, matchpathcon, semanage fcontext -l -C.
• restorecon -v FILE; curl -s -o /dev/null -w '%{http_code}\n' URL.
• getsebool, setsebool (with -P it lasts), semanage boolean -l.
• chcon -t admin_home_t; semanage permissive -a httpd_t and -d; ausearch -m AVC -ts recent -f secret.txt | audit2allow -M labweb; semodule -i labweb.pp, semodule -l, semodule -r labweb.
• semanage login -a -s user_u confined, semanage login -l; ssh-keygen, the user's ~/.ssh/authorized_keys, restorecon -R.