Chris Tyler - Fedora Linux

There is also a manpage provided for each of the most popular servers protected by SELinux. These manpages are named service _selinux ; for example, to access a description of the SELinux booleans that affect httpd , view the httpd_selinux manpage:

$ man httpd_selinux

To see a list of all the service-specific manpages for SELinux, enter the command:

$ apropos _selinux

In the BOOLEAN section you will find this text:

httpd scripts by default are not allowed to connect out to the network.

This would prevent a hacker from breaking into you httpd server

and attacking other machines. If you need scripts to be able to

connect you can set the httpd_can_network_connect boolean on.

setsebool -P httpd_can_network_connect 1

To translate between the descriptions shown in the graphical Security Level Configuration tool and the boolean names used by setsebool and getsebool , use the file /usr/share/system-config-securitylevel/selinux.tbl , which looks like this:

unlimitedUtils _("Admin") _("Allow privileged utilities like hotplug and insmod to run unconfined.")

unlimitedRC _("Admin") _("Allow rc scripts to run unconfined, including any daemon started by an rc script that does not have a domain transition explicitly defined.")

unlimitedRPM _("Admin") _("Allow rpm to run unconfined.")

staff_read_sysadm_file _("Admin") _("Allow staff_r users to search the sysadm home dir and read files (such as ~/.bashrc)")

direct_sysadm_daemon _("Admin") _("Allow sysadm_t to directly start daemons")

...(Lines snipped)...

Each line consists of the boolean name used by setsebool / getsebool , followed by the configuration category and the description used by the Security Level Configuration tool.

Use grep with a server name, boolean name, or a description from the configuration tool to quickly find values in this file:

$ cd /usr/share/system-config-securitylevel

$ grep httpd selinux.tbl

httpd_enable_cgi _("HTTPD Service") _("Allow HTTPD cgi support")

httpd_can_network_connect _("HTTPD Service") _("Allow HTTPD scripts and modules to connect to the network.")

httpd_enable_homedirs _("HTTPD Service") _("Allow HTTPD to read home directories")

httpd_ssi_exec _("HTTPD Service") _("Allow HTTPD to run SSI executables in the same domain as system CGI scripts.")

httpd_builtin_scripting _("HTTPD Service") _("Allow HTTPD to support built-in scripting")

httpd_disable_trans _("HTTPD Service") _("Disable SELinux protection for httpd daemon")

httpd_suexec_disable_trans _("HTTPD Service") _("Disable SELinux protection for http suexec")

httpd_unified _("HTTPD Service") _("Unify HTTPD handling of all content files.")

httpd_tty_comm _("HTTPD Service") _("Unify HTTPD to communicate with the terminal. Needed for handling certificates.")

$ grep "Allow ftp to read/write files in the user home directories" selinux.tbl

ftp_home_dir _("FTP") _("Allow ftp to read/write files in the user home directories")

$ grep unlimitedRPM selinux.tbl

unlimitedRPM _("Admin") _("Allow rpm to run unconfined.")

Table 8-1 contains some of the most commonly altered SELinux booleans.

Table 8-1. Commonly altered SELinux booleans

SELinux uses file labels to specify an SELinux context for each file. To display the context labels, use the -Z or --context options to ls :

$ ls -Z /etc

-rw-r--r-- root root system_u:object_r:etc_t a2ps.cfg

-rw-r--r-- root root system_u:object_r:etc_t a2ps-site.cfg

drwxr-xr-x root root system_u:object_r:etc_t acpi

-rw-r--r-- root root system_u:object_r:adjtime_t adjtime