2 - Raspberry PI Community Projects

The aptitude install selinux-basics selinux-policy-default command will automatically
install the packages required to configure an SELinux system.
The selinux-policy-default package contains a set of standard rules. By default, this policy only
restricts access for a few broadly exposed services. The user sessions are not restricted and it is
thus unlikely that SELinux would block legitimate user operations. However, this does enhance
the security of system services running on the machine. To setup a policy equivalent to the old
“strict” rules, you just have to disable the unconfined module (modules management is detailed
further in this section).
Once the policy has been installed, you should label all the available files (which means assigning
them a type). This operation must be manually started with fixfiles relabel.
The SELinux system is now ready. To enable it, you should add the selinux=1 parameter to
the Linux kernel. The audit=1 parameter enables SELinux logging which records all the denied
operations. Finally, the enforcing=1 parameter brings the rules into application: without
it SELinux works in its default permissive mode where denied actions are logged but still executed.
You should thus modify the GRUB bootloader configuration file to append the desired
parameters. One easy way to do this is to modify the GRUB_CMDLINE_LINUX variable in
/etc/default/grub and to run update-grub. SELinux will be active after a reboot.
It is worth noting that the selinux-activate script automates those operations and forces a
labeling on next boot (which avoids new non-labeled files created while SELinux was not yet
active and while the labeling was going on).
14.4.3. Managing an SELinux System
The SELinux policy is a modular set of rules, and its installation detects and enables automatically
all the relevant modules based on the already installed services. The system is thus immediately
operational. However, when a service is installed after the SELinux policy, you must be
able to manually enable the corresponding module. That is the purpose of the semodule command.
Furthermore, you must be able to define the roles that each user can endorse, and this
can be done with the semanage command.
Those two commands can thus be used to modify the current SELinux configuration, which is
stored in /etc/selinux/default/. Unlike other configuration files that you can find in /etc/,
all those files must not be changed by hand. You should use the programs designed for this
purpose.
GOING FURTHER
More documentation
Since the NSA doesn't provide any official documentation, the community set
up a wiki to compensate. It brings together a lot of information, but you must
be aware that most SELinux contributors are Fedora users (where SELinux is
enabled by default). The documentation thus tends to deal specifically with
that distribution.
➨ http://www.selinuxproject.org
You should also have a look at the dedicated Debian wiki page as well as
Russel Coker's blog, who is one of the most active Debian developers working
on SELinux support.
Chapter 14 — Security
391