1 00:00:00,000 --> 00:00:10,160 To work with SELinux, the first thing you need to take care of is that it is in the 2 00:00:10,160 --> 00:00:11,440 appropriate mode. 3 00:00:11,440 --> 00:00:14,840 So SELinux can be used in different states. 4 00:00:14,840 --> 00:00:17,440 It is either disabled or enabled. 5 00:00:17,440 --> 00:00:22,020 That is something that you enable in the kernel, and it can only be set while booting. 6 00:00:22,020 --> 00:00:28,080 By using the bootline arguments, SELinux is 0 or SELinux is 1. 7 00:00:28,080 --> 00:00:33,279 If SELinux is enabled, you can toggle between permissive and enforcing mode. 8 00:00:33,279 --> 00:00:38,040 In permissive mode, nothing is blocked, but all SELinux events are logged. 9 00:00:38,040 --> 00:00:42,639 That makes permissive mode an excellent mode to find out what is happening when you want 10 00:00:42,639 --> 00:00:46,619 to enable an application for SELinux. 11 00:00:46,619 --> 00:00:50,840 In enforcing mode, SELinux is fully operational. 12 00:00:50,840 --> 00:00:55,560 You can use getEnforce to get the current mode, and you can use setEnforce to set the 13 00:00:55,560 --> 00:00:56,560 current mode. 14 00:00:57,439 --> 00:00:59,759 Let me show you how this works. 15 00:00:59,759 --> 00:01:04,760 So getEnforce is telling me that currently I'm in enforcing mode, and enforcing mode 16 00:01:04,760 --> 00:01:09,360 that means that SELinux is fully operational, fully protected. 17 00:01:09,360 --> 00:01:11,320 Now let me simulate a situation. 18 00:01:11,320 --> 00:01:20,959 I'm going to edit etc.httpd.conf, and in this configuration, I'm going to start my example 19 00:01:20,959 --> 00:01:24,000 that we will work out in the next couple of lessons. 20 00:01:24,040 --> 00:01:29,639 In this example, I'm going to use document root slash web, and I also need to change 21 00:01:29,639 --> 00:01:36,160 the Apache configuration a little bit to loosen security settings on this custom document 22 00:01:36,160 --> 00:01:37,160 root. 23 00:01:37,160 --> 00:01:38,160 All right. 24 00:01:38,160 --> 00:01:45,199 Next, I'm going to create this slash web directory, and I'm creating the file index.html with 25 00:01:45,199 --> 00:01:47,879 text like hello world. 26 00:01:48,239 --> 00:01:49,239 Okay. 27 00:01:49,239 --> 00:01:57,879 So now I'm going to use systemctl enable minus minus now httpd to start it, and I'm using 28 00:01:57,879 --> 00:02:01,120 curl to local host. 29 00:02:01,120 --> 00:02:02,120 And what is going on? 30 00:02:02,120 --> 00:02:07,959 Well, what you see here is the default embedded Apache web server error page telling us that 31 00:02:07,959 --> 00:02:14,080 Apache can't read its document root, and probably the administrator needs to do something. 32 00:02:14,080 --> 00:02:21,320 Now at this point, I'm going to use set and force permissive, and I'm going to try again. 33 00:02:21,320 --> 00:02:24,880 So now SCLinux is in permissive mode, and it still fails. 34 00:02:24,880 --> 00:02:29,600 Now we can draw an important conclusion, and that is that the error apparently is not because 35 00:02:29,600 --> 00:02:30,600 of SCLinux. 36 00:02:30,600 --> 00:02:35,639 We will further investigate what is going on, but the thing here is that in permissive 37 00:02:35,639 --> 00:02:39,800 mode, you are sure that SCLinux is allowing everything. 38 00:02:39,800 --> 00:02:47,320 Now you can also find out using grep avc on var log audit audit.log to check if anything 39 00:02:47,320 --> 00:02:53,119 has happened for SCLinux, and oh, here I can see we are in permissive mode, and the only 40 00:02:53,119 --> 00:02:59,000 thing that I can see is error messages regarding mdadm, and you know what that means? 41 00:02:59,000 --> 00:03:01,839 That means that the problem is not SCLinux related. 42 00:03:01,839 --> 00:03:04,679 My problem is Apache related. 43 00:03:04,679 --> 00:03:09,919 Now let me also show you how you can disable SCLinux, because there's no set and force 44 00:03:09,919 --> 00:03:10,919 disable. 45 00:03:10,919 --> 00:03:19,080 That's for security reasons, as you need to reboot if you want to disable SCLinux. 46 00:03:19,080 --> 00:03:24,320 And you need to get access to the grep boot menu, and in the grep boot menu, oh, we still 47 00:03:24,320 --> 00:03:27,360 have to choose a name and password, well, that is okay. 48 00:03:27,360 --> 00:03:28,679 I can handle it. 49 00:03:28,679 --> 00:03:34,160 In the grep boot menu, at the end of the line that reads Linux, I'm going to use SCLinux 50 00:03:34,160 --> 00:03:41,240 is zero, and then I'm using control X, and that will start the system again with SCLinux 51 00:03:41,240 --> 00:03:43,720 in disabled mode. 52 00:03:43,720 --> 00:03:49,960 Now you should never use SCLinux in disabled mode as a temporary solution, because if you 53 00:03:49,960 --> 00:03:56,600 are in disabled mode, then nothing is protected, nothing is traced by SCLinux, and it might 54 00:03:56,600 --> 00:04:02,880 mess up your SCLinux security settings, and for that reason, when you get out of disabled 55 00:04:02,880 --> 00:04:10,160 mode, you will very often see that your system is going to relabel the SCLinux context settings. 56 00:04:10,160 --> 00:04:14,000 I'll tell you later what that is and how that works. 57 00:04:14,000 --> 00:04:21,880 We will see it, but for now, I'd like to show you the current SCLinux mode. 58 00:04:21,880 --> 00:04:26,720 So get and force is telling me that SCLinux is disabled. 59 00:04:26,720 --> 00:04:28,399 Now back to Apache. 60 00:04:28,399 --> 00:04:29,880 What is going on in Apache? 61 00:04:30,040 --> 00:04:41,399 Well, let's go to var log, because in var log, we have an Apache log, and that is in 62 00:04:41,399 --> 00:04:45,600 HTTPd, and in this HTTPd, you can see an error log. 63 00:04:45,600 --> 00:04:51,440 I'm going to check on the error log if we can see any obvious errors, and what do I 64 00:04:51,440 --> 00:04:51,799 see? 65 00:04:51,799 --> 00:04:58,440 I see cannot serve var www.html, no matching directory found. 66 00:04:58,440 --> 00:05:01,200 Is this the message that we are talking about? 67 00:05:01,200 --> 00:05:03,279 804, that is likely. 68 00:05:03,279 --> 00:05:10,720 So what I'm seeing here is that apparently it's still trying to serve var www.html, and 69 00:05:10,720 --> 00:05:14,200 it doesn't use slash web as a document route at all. 70 00:05:14,200 --> 00:05:15,720 Okay, is that so? 71 00:05:15,720 --> 00:05:27,679 Let's try on etc.httpd.conf, where I can see my document route being set to slash web. 72 00:05:27,679 --> 00:05:31,880 Now that is interesting, and I need to try it again. 73 00:05:31,880 --> 00:05:40,559 I'm going to use systemctl restart HTTPd, and then I'm going to check this error log 74 00:05:40,559 --> 00:05:41,279 again. 75 00:05:41,279 --> 00:05:51,119 So right now it is 0808 in my time zone, so we are looking for timestamps following 0808, 76 00:05:51,119 --> 00:05:54,440 and I don't see this timestamp anymore. 77 00:05:54,440 --> 00:05:55,760 So what happened? 78 00:05:55,760 --> 00:06:00,720 Well, I'm not really sure what happened, but apparently I didn't start Apache after the 79 00:06:00,720 --> 00:06:02,600 modification was made. 80 00:06:02,600 --> 00:06:03,839 So what does that mean? 81 00:06:03,839 --> 00:06:09,480 Well, it means that if I'm going to use my curl to local host again, I see hello world, 82 00:06:09,480 --> 00:06:15,040 and I see hello world because I'm in disabled mode, and now I'm getting back into enforcing 83 00:06:15,040 --> 00:06:20,920 mode, and while restarting, we can see that the auto-relabel is taking place right now. 84 00:06:20,920 --> 00:06:22,239 You can see that on my screen. 85 00:06:22,239 --> 00:06:25,200 Once the auto-relabel is done, it will restart again. 86 00:06:25,200 --> 00:06:30,920 That is normal, and that is expected behavior, but this is happening because STLinux temporarily 87 00:06:30,920 --> 00:06:36,040 was not protecting the system, and STLinux needs to verify that everything is still okay. 88 00:06:36,040 --> 00:06:39,399 So that is why you see two different reboots. 89 00:06:39,399 --> 00:06:45,200 So now I'm back on my system, and as I did not change anything persistently in GRUB, 90 00:06:45,200 --> 00:06:51,640 getEnforce is giving me enforcing, so when I use curl to local host, I'm getting this 91 00:06:52,040 --> 00:06:56,920 Apache error page, and now I can demonstrate permissive mode because in permissive mode, 92 00:06:56,920 --> 00:07:01,559 setEnforce, permissive is what I'm going to need. 93 00:07:01,559 --> 00:07:06,279 Curl local host, suddenly it works, and what was the big deal about this GRUB? 94 00:07:06,279 --> 00:07:14,279 Well, when I use GRUB AVC on var log audit, audit.log, I can see a trace of all the STLinux 95 00:07:14,279 --> 00:07:17,920 messages, and what we are looking for is permissive is one. 96 00:07:18,079 --> 00:07:23,279 This is all that has been logged in permissive mode, and this is what we need to go troubleshoot 97 00:07:23,279 --> 00:07:24,559 later. 98 00:07:24,559 --> 00:07:25,559 So what do we see? 99 00:07:25,559 --> 00:07:31,760 Command HTTP, bad index HTML, we get AVC denied. 100 00:07:31,760 --> 00:07:37,200 All STLinux messages are logged with AVC denied, if there's a denial, and there you can see 101 00:07:37,200 --> 00:07:42,760 the source context HTTP underscore T, trying to reach out the target context default underscore 102 00:07:42,760 --> 00:07:46,359 T, and in the next video, I will tell you all about the meaning of that.