SELinux Cookbook

• Design custom SELinux policies and understand the reference policy interface constructions to build readable SELinux policy rules
• Experience the wide range of security controls SELinux offers by customizing web application confinement
• Step-by-step recipes exploring the SELinux environment

Who This Book Is For

If you are a Linux system administrator or a Linux-based service administrator and want to fine-tune SELinux to implement a supported, mature, and proven access control system, then this book is for you. Basic experience with SELinux enabled distributions is expected.

What You Will Learn

• Manage resource labels and fine-tune your policies to automatically handle labeling
• Gain an insight into how to tune the web server SELinux policy for secure web application hosting
• Learn how to confine desktop applications through custom-built policies
• Protect a server's assets by creating your own service-specific SELinux policies
• Discover how to restrict users without hindering them by installing role-based access control
• Troubleshoot and debug the behavior of SELinux-enabled applications

In Detail

In SELinux Cookbook, we cover everything from how to build SELinux policies to the integration of the technology with other systems and look at a wide range of examples to assist in creating additional policies. The first set of recipes work around file labeling as one of the most common and important SELinux administrative aspects. Then, we move on to custom policy development, showing how this is done for web application confinement, desktop application protection, and custom server policies. Next, we shift our focus to the end user, restricting user privileges and setting up role-based access controls. After that, we redirect our focus to the integration of SELinux with Linux systems, aligning SELinux with existing security controls on a Linux system. Finally, we will learn how applications interact with the SELinux subsystem internally; ensuring that whatever the challenge, we will be able to find the best solution.

About the Author

Sven Vermeulen is a long-term contributor to various free software projects and the author of various online guides and resources. He got his first taste of free software in 1997 and never looked back. In 2003, he joined the ranks of the Gentoo Linux project as a documentation developer and has since worked in several roles, including Gentoo Foundation trustee, council member, project lead for various documentations, and (his current role) project lead for Gentoo Hardened SELinux integration and the system integrity project. During this time, Sven gained expertise in several technologies, ranging from operating system level knowledge to application servers. He used his interest in security to guide his projects further in the areas of security guides using SCAP languages, mandatory access controls through SELinux, authentication with PAM, (application) firewalling, and more. Within SELinux, Sven contributed several policies to the Reference Policy project, and he is actively participating in the policy development and user space development projects. In his daily job, Sven is an IT infrastructure architect with a European financial institution. The secure implementation of infrastructures (and the surrounding architectural integration) is, of course, an important part of this. Prior to this, he graduated as an MSE in Computer Engineering from Ghent University, and then worked as a web application infrastructure engineer using IBM WebSphere Application Server. Sven is the main author of Gentoo Handbook, which covers the installation and configuration of Gentoo Linux on several architectures. He has also authored the Linux Sea online publication, which is a basic introduction to Linux for novice system administrators and SELinux System Administration, Packt Publishing, which covers SELinux for system administrators.