Very strict SELinux for application

[mmehrwald]

Hi,

I don't know very much about SELinux so I need your tips how to achieve what I want to do. I don't need a solution but hints where to start and what to read.

I want to have an application which is allowed to read/write a config file, update the system (using yum) and updating itself and has access to some of the hardware. Nothing else should be possible. The application will be started on bootup and closing it will shutdown the hole system. There should be no user or at least not more users then needed to boot the system and run the app.

How do I know which system services (e.g. log) need which permissions and how can I make sure that nothing else has access to anything except of the few things my app needs?

Please send me any kind of links and ideas you have.

[domg472]

By testing your policy module.

You start with a basic policy module that takes care of creating types for important objects and subjects that are part of your app, then you make the types usable. Then you add file context specifications for the files that have a private type so that the selinux knows how the files should be labeled

Then you take care of file and domain type transitions that you know of. You also take care of rules related to role base access control (e.g. allow a role access to the process types)

Then its basically testing in permissive mode, analyzing the AVC denials that you will be seeing ( as SELinux block all access by default and you haven't added much if any rules to allow access yet)

Then based on the avc denials you make security decisions and extend your policy module. Repeat untill all works as desired.

http://danwalsh.livejournal.com/
https://docs.fedoraproject.org/en-US...ined_Services/
https://docs.fedoraproject.org/en-US...nhanced_Linux/
selinuxbyexample.com
selinuxproject.org
http://www.freetechbooks.com/the-sel...ions-t785.html
http://oss.tresys.com/projects/refpo.../Documentation
http://git.fedorahosted.org/cgit/selinux-policy.git/
https://www.youtube.com/user/domg472...e=results_main
https://www.nsa.gov/research/selinux/docs.shtml
http://marc.info/?l=selinux&r=1&w=2