Red Hat Enterprise Linux 5 Administration Unleashed

470CHAPTER 23Protecting Against Intruders with Security-Enhanced LinuxCAUTIONThe tar utility commonly used when creating archives for backup purposes does notpreserve extended attributes of the filesystem. To back up a filesystem and itsSELinux labels, use the star utility, which is similar to tar. The star RPM packagemust be installed to use it. Refer to the star man page for details.Viewing Security ContextsFile utilities such as ls and ps do not display SELinux security context by default. Use the-Z option for most file utilities to view this content such as ls -Z and ps -Z. Forexample, when the -Z option is used with ls to view the /etc/sysconfig/ directory, thesecurity context is shown such as the following:-rw-r—r— root root system_u:object_r:etc_tdrwxr-xr-x root root system_u:object_r:etc_t-rw-r——- root root system_u:object_r:etc_t-rw-r—r— root root system_u:object_r:etc_t-rw-r—r— root root system_u:object_r:etc_t-rw-r—r— root root system_u:object_r:etc_tapmdapm-scriptsauditdauthconfigautofsbluetoothThe cp and mv commands for copying and moving files handle file contexts differently.By default, the cp command creates a new file in the desired location with a type basedon the creating process and the parent directory of the desired location. For example, ifthe file is copied from the /etc/ directory to a backup directory, the type field of the filechanges from etc_t to whatever the default type is for the target directory. The -Z optionto cp can be used to specify a type to use when copying the file:cp -Z file /new/locationThe mv command to move files preserves the file context of the files by default. If the fileneeds a different type in the new location, be sure to relabel the file with the chconcommand:chcon -t Modifying Security ContextsTo better understand the impact and usage of security contexts, consider an exampleconcerning the Apache HTTP Server. If you are not familiar with the web server, refer toChapter 15, “Creating a Web Server with Apache HTTP Server.”It is common to change the default DocumentRoot to something other than/var/www/html/. Perhaps you need files to come from network storage mounted in adifferent directory. SELinux protects the httpd process and only allows the web server toserve files and directories with a specific security context.The security context of the default files in the /var/www/ directory is shown in Listing23.2. The output is from the ls -d -Z /var/www;ls -Z /var/www command.