Red Hat Enterprise SELinux Policy Administration with Exam

Skills required for SELinux policy writing

Introduction to SELinux

Discretionary access control vs. mandatory access control

  • SELinux history and architecture overview
  • Elements of the SELinux security model: user identity and role; domain and type; sensitivity and categories; security context
  • SELinux Policy and Red Hat's targeted policy
  • Configuring policy with booleans
  • Archiving
  • Setting and displaying extended attributes

Using SELinux

  • Controlling SELinux
  • File contexts
  • Relabeling files and file systems
  • Mount options

The Red Hat® Targeted Policy

  • Identifying and toggling protected services
  • Apache security contexts and configuration booleans
  • Name service contexts and configuration booleans
  • NIS client contexts
  • Other services
  • File context for special directory trees
  • Troubleshooting and avc denial messages
  • SE troubleshooting and logging

Introduction to policies

  • Policy overview and organization
  • Compiling and loading the monolithic policy and policy modules
  • Policy type enforcement module syntax
  • Object classes
  • Domain transition

Policy utilities

  • Tools available for manipulating and analyzing policies: apol; seaudit and seaudit_report; checkpolicy; sepcut; sesearch; sestatus; audit2allow and audit2why; sealert; avcstat; seinfo; semanage and semodule; Man pages

User and role security

  • Role-based access control
  • Multicategory security
  • Defining a Security Administrator
  • Multilevel security
  • The strict policy
  • User identification and declaration
  • Role identification and declaration
  • Roles in use in transitions
  • Role dominance

Anatomy of a policy

  • Policy macros
  • Type attributes and aliases
  • Type transitions
  • When and how do files get labeled
  • restorecond
  • Customizable types

Manipulating policies

  • Installing and compiling policies
  • The policy language
  • Access vector
  • SELinux logs
  • Security Identifiers (SIDs)
  • File system labeling behavior
  • Context on network objects
  • Creating and using new booleans
  • Manipulating policy by example
  • Macros
  • Enableaudit

Project

  • Best practices
  • Create file contexts, types, and typealiases
  • Edit and create network contexts
  • Edit and create domains

Note: Course outline is subject to change with technology changes and as nature of the underlying job evolves. For questions or confirmation on a specific objective or topic please contact a training specialist via the web or at 1-866-626-2994.