SELinux Cookbook

Over 70 hands-on recipes to develop fully functional policies to confine your applications and users using SELinux

About This Book

• Design custom SELinux policies and understand the reference policy interface constructions to build readable SELinux policy rules
• Experience the wide range of security controls SELinux offers by customizing web application confinement
• Step-by-step recipes exploring the SELinux environment

Who This Book Is For

If you are a Linux system administrator or a Linux-based service administrator and want to fine-tune SELinux to implement a supported, mature, and proven access control system, then this book is for you. Basic experience with SELinux enabled distributions is expected.

In Detail

In SELinux Cookbook, we cover everything from how to build SELinux policies to the integration of the technology with other systems and look at a wide range of examples to assist in creating additional policies. The first set of recipes work around file labeling as one of the most common and important SELinux administrative aspects. Then, we move on to custom policy development, showing how this is done for web application confinement, desktop application protection, and custom server policies. Next, we shift our focus to the end user, restricting user privileges and setting up role-based access controls. After that, we redirect our focus to the integration of SELinux with Linux systems, aligning SELinux with existing security controls on a Linux system. Finally, we will learn how applications interact with the SELinux subsystem internally; ensuring that whatever the challenge, we will be able to find the best solution.

Table of Contents

Chapter 1. The SELinux Development Environment
Chapter 2. Dealing with File Labels
Chapter 3. Confining Web Applications
Chapter 4. Creating a Desktop Application Policy
Chapter 5. Creating a Server Policy
Chapter 6. Setting Up Separate Roles
Chapter 7. Choosing the Confinement Level
Chapter 8. Debugging SELinux
Chapter 9. Aligning SELinux with DAC
Chapter 10. Handling SELinux-aware Applications