Red Hat Enterprise Linux 5 Administration Unleashed

466CHAPTER 23Protecting Against Intruders with Security-Enhanced LinuxSelecting and Customizing the SELinux PolicyIf permissive or enforcing mode is enabled, an SELinux policy must be selected to determinewhich programs are governed by SELinux and which are run in unconfined space.The SELinux policy sets what programs are protected under SELinux. The default policy,called the targeted policy, in Red Hat Enterprise Linux is designed to protect the systemwithout being intrusive to the users.The following policies are available:. targeted (default): Works for most server and client systems. Protects users fromapplications and system processes while leaving userspace unconfined so the securitymeasures are mostly undetectable to most users. Requires the selinux-policytargetedpackage to be installed.. strict: Very controlled environment in which most system and user processes havevery limited access to the filesystem. Users are only granted access to specific directoriesfor maximum security, and system processes are only granted access to directoriesto which they need access to run. If an application is configured to use nondefaultdirectories, the policy must be changed to allow the application to access the nondefaultdirectories. Requires the selinux-policy-strict package to be installed.. mls: Allows security to be mapped out according to multiple levels of security.Developed for servers requiring EAL4+/LSPP certification. Useful for organizationsthat grant security rights based on a user’s security level. Requires the selinuxpolicy-mlspackage to be installed.To change the SELinux policy, first install the corresponding package. To change thepolicy from the SELinux Management Tool, go to the Status view and select the desiredpolicy from the System Default Policy Type pull-down menu. Only installed policies areavailable for selection.To change from the command line, set the SELINUXTYPE option in the/etc/selinux/config file to targeted, strict, or mls such as the following:SELINUXTYPE=targetedA reboot is required after selecting a different policy so that the filesystem can be relabeled.Remember to back up the filesystem before changing the SELinux policy. After thereboot, verify the policy was changed by executing the sestatus command. The outputshould look similar to Listing 23.1.When changing the policy, setting the mode to permissive allows the administrator totest the policy without enabling it at first. After reviewing the SELinux alerts and systemlog files for any errors or warnings for a testing period, the mode can be changed frompermissive to enforcing as described in the “Selecting an SELinux Mode” section.Major modifications to the policy require the policy source to be modified and the sourceto be recompiled. However, policies do allow minor changes to it without recompiling by