SELinux System Administration - Third Edition by Sven Vermeulen

Author:Sven Vermeulen [Sven Vermeulen]
Language: eng
Format: epub
Publisher: Packt Publishing
Published: 2020-12-04T00:00:00+00:00

Governing unit operation access

Until now, we've looked at configuration settings related to systemd's SELinux support. systemd also uses SELinux to control access to services defined through unit files. When a user wants to perform an operation against a unit (such as starting a service or checking the state of a running service), systemd queries the SELinux policy to see whether it will allow this operation.

The systemd daemon uses the service class to validate the permissions of the client's domain toward the requested operation. For instance, to validate whether a user context, sysadm_t, can view the status of the service associated with the sshd.service unit file, it checks the context of this file (being sshd_unit_file_t) and then validates whether the status permission is granted:

# sesearch -s sysadm_t -t sshd_unit_file_t -c service -p status -A

Other supported permissions are disable, enable, reload, start, and stop. When a permission is not granted, a USER_AVC denial message will be visible in the audit logs (rather than an AVC message) as the message is not generated by the Linux kernel, but by systemd. So, while the rules themselves are part of the SELinux policy, it is systemd that enforces the access.

systemd, or the client through which systemd is queried, might also provide additional error messages to reflect that the SELinux policy prevents the action. For instance, if we attempt to query systemd over D-Bus (which we cover in the D-Bus communication section) from an unprivileged user domain, then we get the following error:

Error: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: SELinux policy denies access

To facilitate troubleshooting any systemd-triggered failures, systemd also has an extensive logging component, called systemd-journald, which we'll cover next.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.