Duration
4 days
Course Description
Security-enhanced Linux (SELinux) is a powerful, kernel-level security layer that provides fine-grained control over which users and processes may access what resources and execute which programs on a system. Red Hat Enterprise SELinux Policy Administration (RHS429) introduces senior system administrators, security administrators, and application programmers to SELinux policy writing.
Students will learn how SELinux works and how to manage, write, compile, and debug an SELinux policy. This class culminates in a major project to analyze, determine the security needs of, and design and implement a set of net new policies for a service previously unprotected by SELinux.
An Red Hat Certified Engineer (RHCE) who successfully completes this course is prepared to take the Red Hat Enterprise SELinux Policy Administration Expertise Exam (EX429).
Audience:
- Experienced Linux system administrators responsible for Mandatory Access Control-based (MAC) security, or who want to harden their existing Linux system or networked services security
- RHCEs interested in earning a Red Hat Certificate of Expertise or a Red Hat Certified Security Specialist (RHCSS) certification
Prerequisites:
- The essential elements of how to configure the services covered, as this course will be focusing on more advanced topics
- RHCE certification or equivalent experience
- Candidates who are not an RHCE are encouraged to check their experience levels by taking a free pre-assessment test at redhat.com/training/assessment
Course Outline
- Discretionary Access Control vs. Mandatory Access Control
- SELinux History and Architecture Overview
- Elements of the SELinux security model:
- user identity and role
- domain and type
- sensitivity and categories
- security context
- SELinux Policy and Red Hat's Targeted Policy
- Configuring Policy with Booleans
- Archiving
- Setting and Displaying Extended Attributes
- Hands-on Lab: Understanding SELinux
- Controlling SELinux
- File Contexts
- Relabeling Files and Filesystems
- Mount options
- Hand-on Lab: Working with SELinux
- Identifying and Toggling Protected Services
- Apache Security Contexts and Configuration Booleans
- Name Service Contexts and Configuration Booleans
- NIS Client Contexts
- Other Services
- File Context for Special Directory Trees
- Troubleshooting and avc Denial Messages
- setroubleshootd and Logging
- Hands-on Lab: Understanding and Troubleshooting the Red Hat Targeted Policy
- Policy Overview and Organization
- Compiling and Loading the Monolithic Policy and Policy Modules
- Policy Type Enforcement Module Syntax
- Object Classes
- Domain Transition
- Hands-on Lab: Understanding policies
- Tools available for manipulating and analyzing policies
- apol
- seaudit and seaudit_report
- checkpolicy
- sepcut
- sesearch
- sestatus
- audit2allow and audit2why
- sealert
- avcstat
- seinfo
- semanage and semodule
- Man pages
- Hands-on Lab: Exploring Utilities
- Role-based Access Control
- Multi Category Security
- Defining a Security Administrator
- Multi-Level Security
- The strict Policy
- User Identification and Declaration
- Role Identification and Declaration
- Roles in Use in Transitions
- Role Dominance
- Hands-on Lab: Implementing User and Role Based Policy Restrictions
- Policy Macros
- Type Attributes and Aliases
- Type Transitions
- When and How do Files Get Labeled
- restorecond
- Customizable Types
- Hands-on Lab: Building Policies
- Installing and Compiling Policies
- The Policy Language
- Access Vector
- SELinux logs
- Security Identifiers - SIDs
- Filesystem Labeling Behavior
- Context on Network Objects
- Creating and Using New Booleans
- Manipulating Policy by Example
- Macros
- Enableaudit
- Hands-on Lab: Compiling Policies
- Best practices
- Create File Contexts, Types and Typealiases
- Edit and Create Network Contexts
- Edit and Create Domains
- Hands-on Lab: Editing and Writing Policy
This is a version-specific reference outline. Confirm the current syllabus and delivery arrangements with EIEIO.