[gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/

public inbox for gentoo-commits@lists.gentoo.org
 help / color / mirror / Atom feed

From: "Sven Vermeulen" <sven.vermeulen@siphos.be>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/
Date: Sat, 15 Oct 2011 18:24:50 +0000 (UTC)	[thread overview]
Message-ID: <db384261df8fbd156ea90477c06f81e39a1f3577.SwifT@gentoo> (raw)

commit:     db384261df8fbd156ea90477c06f81e39a1f3577
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Oct 15 18:24:36 2011 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 15 18:24:36 2011 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=db384261

Updating the "switching from permissive to enforcing"

---
 xml/selinux/hb-using-policies.xml |   52 +++++++++++++++++++++++++++++++++++++
 xml/selinux/hb-using-states.xml   |   21 +++++++++++++++
 2 files changed, 73 insertions(+), 0 deletions(-)

diff --git a/xml/selinux/hb-using-policies.xml b/xml/selinux/hb-using-policies.xml
index 5d5f008..03751e1 100644
--- a/xml/selinux/hb-using-policies.xml
+++ b/xml/selinux/hb-using-policies.xml
@@ -341,4 +341,56 @@ optional_policy(`
 </body>
 </subsection>
 </section>
+
+<section>
+<title>Using audit2allow</title>
+<subsection>
+<title>Introduction</title>
+<body>
+
+<p>
+When reading online resources on SELinux, you will notice that there are many
+references to a tool called <c>audit2allow</c>. This tools' purpose is to read
+AVC denial messages from the audit log file and transform them into a policy
+module that you can load. The advantage is that it makes it a lot easier to
+write policies. The downside is that the output (unless you use the <c>-R</c>
+option) is not usable for the <path>Makefile</path> we used earlier to build
+modules.
+</p>
+
+<p>
+Another disadvantage is that the tool does not intelligently cope with changes.
+It blindly accepts denials and treats them as if they need to be allowed, rather
+than investigate if no other context should be given to the file, etc.
+</p>
+
+</body>
+</subsection>
+<subsection>
+<title>Using audit2allow</title>
+<body>
+
+<p>
+Using <c>audit2allow</c> is pretty straightforward. You send it the denials you
+want to fix and store the result in a <path>.te</path> file. You then convert it
+into an intermediary format which can then be translated into a <path>.pp</path>
+file for final loading by <c>semodule</c>.
+</p>
+
+<p>
+For instance, to catch all denials and transform them into allowed statements
+from firefox-related denials:
+</p>
+
+<pre caption="Generate a new policy using audit2allow">
+# <i>grep firefox /var/log/avc.log | audit2allow -m firefoxmod &gt; firefoxmod.te</i>
+# <i>checkmodule -m -o firefoxmod.mod firefoxmod.te</i>
+# <i>semodule_package -o firefoxmod.pp -m firefoxmod.mod</i>
+# <i>semodule -i firefoxmod.pp</i>
+</pre>
+
+</body>
+</subsection>
+</section>
+
 </sections>

diff --git a/xml/selinux/hb-using-states.xml b/xml/selinux/hb-using-states.xml
index 8702550..e379547 100644
--- a/xml/selinux/hb-using-states.xml
+++ b/xml/selinux/hb-using-states.xml
@@ -168,6 +168,27 @@ Using the <path>/etc/selinux/config</path> <c>SELINUX</c> variable:
 SELINUXTYPE=strict
 </pre>
 
+<p>
+When you want to switch from permissive to enforcing, it is recommended to do so
+in the order given above:
+</p>
+
+<ol>
+  <li>
+    First boot up in permissive mode, log on, verify that your context is
+    correct (<c>id -Z</c>) and then switch to enforcing (<c>setenforce 1</c>).
+    You can now test if your system is still working properly.
+  </li>
+  <li>
+    Next, boot with <c>enforcing=1</c> as kernel parameter. This way, your
+    system will boot in enforcing mode, but if things go haywire, you can just
+    reboot, leave out the option and be back in permissive mode
+  </li>
+  <li>
+    Finally, edit <path>/etc/selinux/config</path> to persist this change.
+  </li>
+</ol>
+
 </body>
 </subsection>
 </section>

next             reply	other threads:[~2011-10-15 18:25 UTC|newest]

Thread overview: 95+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-10-15 18:24 Sven Vermeulen [this message]
  -- strict thread matches above, loose matches on Subject: below --
2012-05-07 20:20 [gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/ Sven Vermeulen
2012-05-07 20:07 Sven Vermeulen
2012-05-05 18:56 Sven Vermeulen
2012-04-29 14:22 Sven Vermeulen
2012-04-10 18:22 Sven Vermeulen
2012-04-10 18:22 Sven Vermeulen
2012-04-10 18:22 Sven Vermeulen
2012-04-05 16:24 Sven Vermeulen
2012-03-01 20:09 Sven Vermeulen
2012-01-29 12:42 Sven Vermeulen
2012-01-21 13:20 Sven Vermeulen
2011-12-17 10:52 Sven Vermeulen
2011-12-11 14:39 Sven Vermeulen
2011-12-11 14:36 Sven Vermeulen
2011-12-10 14:00 Sven Vermeulen
2011-11-22 20:08 Sven Vermeulen
2011-11-11 19:59 Sven Vermeulen
2011-10-27 19:18 José María Alonso
2011-10-26 22:05 José María Alonso
2011-10-23 13:01 Sven Vermeulen
2011-10-19 12:55 Sven Vermeulen
2011-10-15 17:43 Sven Vermeulen
2011-10-15 17:12 Sven Vermeulen
2011-10-15 15:54 Sven Vermeulen
2011-10-15 15:18 Sven Vermeulen
2011-10-15 13:04 Sven Vermeulen
2011-10-15 13:04 Sven Vermeulen
2011-09-30 17:36 Sven Vermeulen
2011-09-18 13:49 Sven Vermeulen
2011-09-11  9:51 Sven Vermeulen
2011-09-04 19:22 Sven Vermeulen
2011-08-16 16:58 José María Alonso
2011-08-12 21:00 Sven Vermeulen
2011-07-22 16:03 Sven Vermeulen
2011-07-21 19:11 Sven Vermeulen
2011-07-13 21:39 Sven Vermeulen
2011-07-09 18:56 Sven Vermeulen
2011-06-09 18:54 José María Alonso
2011-06-09 17:49 Sven Vermeulen
2011-06-09 17:40 Francisco Blas Izquierdo Riera
2011-06-09 17:24 Sven Vermeulen
2011-06-07 19:38 Sven Vermeulen
2011-06-07 19:26 Sven Vermeulen
2011-06-02 19:50 Sven Vermeulen
2011-06-02 11:57 Sven Vermeulen
2011-06-02 11:55 Sven Vermeulen
2011-06-02 11:03 Sven Vermeulen
2011-06-02 11:03 Sven Vermeulen
2011-05-31 20:22 Sven Vermeulen
2011-05-31 20:16 Sven Vermeulen
2011-05-31 20:16 Sven Vermeulen
2011-05-24 20:39 Sven Vermeulen
2011-05-24 19:56 Sven Vermeulen
2011-05-20 19:32 Sven Vermeulen
2011-05-14 12:51 Sven Vermeulen
2011-05-13 19:43 Sven Vermeulen
2011-05-03 20:47 Sven Vermeulen
2011-05-03 20:12 Sven Vermeulen
2011-04-22 21:43 Sven Vermeulen
2011-04-22 19:30 Sven Vermeulen
2011-04-22 19:28 Sven Vermeulen
2011-04-22 19:05 Sven Vermeulen
2011-04-22 19:05 Sven Vermeulen
2011-04-22 10:32 Sven Vermeulen
2011-04-22 10:32 Sven Vermeulen
2011-04-16  9:06 Sven Vermeulen
2011-04-15 19:10 Sven Vermeulen
2011-04-15 17:52 Sven Vermeulen
2011-04-15 17:52 Sven Vermeulen
2011-04-10  7:49 Sven Vermeulen
2011-04-01 17:45 Sven Vermeulen
2011-03-09 16:54 Sven Vermeulen
2011-03-02 20:48 Sven Vermeulen
2011-03-02 20:38 Sven Vermeulen
2011-03-02 20:38 Sven Vermeulen
2011-03-02 20:13 Sven Vermeulen
2011-03-02 20:13 Sven Vermeulen
2011-03-02 20:13 Sven Vermeulen
2011-03-02 15:53 Sven Vermeulen
2011-02-24 21:19 Sven Vermeulen
2011-02-20 13:26 Sven Vermeulen
2011-02-19 17:00 Francisco Blas Izquierdo Riera
2011-02-19  3:21 Francisco Blas Izquierdo Riera
2011-02-19  3:12 Francisco Blas Izquierdo Riera
2011-02-13 18:20 Sven Vermeulen
2011-02-12 23:44 Sven Vermeulen
2011-02-12 23:44 Sven Vermeulen
2011-02-12 20:50 Sven Vermeulen
2011-02-12 20:49 Sven Vermeulen
2011-02-12 20:47 Sven Vermeulen
2011-02-12 20:47 Sven Vermeulen
2011-02-12 20:47 Sven Vermeulen
2011-02-12 17:33 Sven Vermeulen
2011-02-06 19:53 Sven Vermeulen

find likely ancestor, descendant, or conflicting patches for this message:
( dfblob:5d5f008 dfblob:03751e1 dfblob:8702550 dfblob:e379547 )
 OR (
bs:"[gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/" )
	(help)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=db384261df8fbd156ea90477c06f81e39a1f3577.SwifT@gentoo \
    --to=sven.vermeulen@siphos.be \
    --cc=gentoo-commits@lists.gentoo.org \
    --cc=gentoo-dev@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox