Course Description:
Security-enhanced Linux (SELinux) is a powerful, kernel-level security layer that provides fine-grained control over which users and processes may access what resources and execute which programs on a system. Red Hat
Enterprise SELinux Policy Administration (RHS429) introduces senior system administrators, security administrators, and application programmers to SELinux policy writing.
Students will learn how SELinux works and how to manage, write, compile, and debug an SELinux policy. This class culminates in a major project to analyze, determine the security needs of, and design and implement a set of net new policies for a service previously unprotected by SELinux.
An Red Hat Certified Engineer (RHCE) who successfully completes this course is prepared to take the Red Hat
Enterprise SELinux Policy Administration Expertise Exam (EX429).
Audience:
Experienced Linux system administrators responsible for Mandatory Access Control-based (MAC) security, or who want to harden their existing Linux system or networked services security
RHCEs interested in earning a Red Hat Certificate of Expertise or a Red Hat Certified Security Specialist
(RHCSS) certification
Prerequisites:
The essential elements of how to configure the services covered, as this course will be focusing on more advanced topics
RHCE certification or equivalent experience
Candidates who are not an RHCE are encouraged to check their experience levels by taking a free pre-assessment test at redhat.com/training/assessment
:: Course RHS429 ::
Course Outline
Discretionary Access Control vs. Mandatory Access Control
SELinux History and Architecture Overview
Elements of the SELinux security model:
user identity and role domain and type sensitivity and categories security context
SELinux Policy and Red Hat's Targeted Policy
Configuring Policy with Booleans
Archiving
Setting and Displaying Extended Attributes
Hands-on Lab: Understanding SELinux
Controlling SELinux
File Contexts
Relabeling Files and Filesystems
Mount options
Hand-on Lab: Working with SELinux
Identifying and Toggling Protected Services
Apache Security Contexts and Configuration Booleans
Name Service Contexts and Configuration Booleans
NIS Client Contexts
Other Services
File Context for Special Directory Trees
Troubleshooting and avc Denial Messages setroubleshootd and Logging
Hands-on Lab: Understanding and Troubleshooting the Red Hat Targeted Policy
Policy Overview and Organization
Compiling and Loading the Monolithic Policy and Policy Modules
Policy Type Enforcement Module Syntax
Object Classes
Domain Transition
Hands-on Lab: Understanding policies
:: Course RHS429 ::
Tools available for manipulating and analyzing policies apol seaudit and seaudit_report checkpolicy sepcut sesearch sestatus audit2allow and audit2why sealert avcstat seinfo semanage and semodule
Man pages
Hands-on Lab: Exploring Utilities
Role-based Access Control
Multi Category Security
Defining a Security Administrator
Multi-Level Security
The strict Policy
User Identification and Declaration
Role Identification and Declaration
Roles in Use in Transitions
Role Dominance
Hands-on Lab: Implementing User and Role Based Policy Restrictions
Policy Macros
Type Attributes and Aliases
Type Transitions
When and How do Files Get Labeled restorecond
Customizable Types
Hands-on Lab: Building Policies
:: Course RHS429 ::
Installing and Compiling Policies
The Policy Language
Access Vector
SELinux logs
Security Identifiers - SIDs
Filesystem Labeling Behavior
Context on Network Objects
Creating and Using New Booleans
Manipulating Policy by Example
Macros
Enableaudit
Hands-on Lab: Compiling Policies
Best practices
Create File Contexts, Types and Typealiases
Edit and Create Network Contexts
Edit and Create Domains
Hands-on Lab: Editing and Writing Policy
This is a version-specific reference outline. Confirm the current syllabus and delivery arrangements with EIEIO.