Using the initial RAM disk (initrd)

initrd provides the capability to load a RAM disk by the boot loader.
This RAM disk can then be mounted as the root file system and programs
can be run from it. Afterwards, a new root file system can be mounted
from a different device. The previous root (from initrd) is then moved
to a directory and can be subsequently unmounted.

initrd is mainly designed to allow system startup to occur in two phases,
where the kernel comes up with a minimum set of compiled-in drivers, and
where additional modules are loaded from initrd.

This document gives a brief overview of the use of initrd. A more detailed
discussion of the boot process can be found in [1].

Operation
---------
When using initrd, the system typically boots as follows:

1) the boot loader loads the kernel and the initial RAM disk
2) the kernel converts initrd into a "normal" RAM disk and
frees the memory used by initrd
3) if the root device is not /dev/ram0, the old (deprecated)
change_root procedure is followed. see the "Obsolete root change
mechanism" section below.
4) root device is mounted. if it is /dev/ram0, the initrd image is
then mounted as root
5) /sbin/init is executed (this can be any valid executable, including
shell scripts; it is run with uid 0 and can do basically everything
init can do).
6) init mounts the "real" root file system
7) init places the root file system at the root directory using the
pivot_root system call
8) init execs the /sbin/init on the new root filesystem, performing
the usual boot sequence
9) the initrd file system is removed

Note that changing the root directory does not involve unmounting it.
It is therefore possible to leave processes running on initrd during that
procedure. Also note that file systems mounted under initrd continue to
be accessible.

Boot command-line options
-------------------------

initrd adds the following new options:

initrd= (e.g. LOADLIN)

Loads the specified file as the initial RAM disk. When using LILO, you
have to specify the RAM disk image file in /etc/lilo.conf, using the
INITRD configuration variable.

noinitrd

initrd data is preserved but it is not converted to a RAM disk and
the "normal" root file system is mounted. initrd data can be read
from /dev/initrd. Note that the data in initrd can have any structure
in this case and doesn't necessarily have to be a file system image.
This option is used mainly for debugging.

Note: /dev/initrd is read-only and it can only be used once. As soon
as the last process has closed it, all data is freed and /dev/initrd
can't be opened anymore.

root=/dev/ram0

initrd is mounted as root, and the normal boot procedure is followed,
with the RAM disk mounted as root.

Compressed cpio images
----------------------

Recent kernels have support for populating a ramdisk from a compressed cpio
archive, on such systems, the creation of a ramdisk image doesn't need to
involve special block devices or loopbacks, you merely create a directory on
disk with the desired initrd content, cd to that directory, and run (as an
example):

find . | cpio --quiet -c -o | gzip -9 -n > /boot/imagefile.img

Examining the contents of an existing image file is just as simple:

mkdir /tmp/imagefile
cd /tmp/imagefile
gzip -cd /boot/imagefile.img | cpio -imd --quiet

Installation
------------
First, a directory for the initrd file system has to be created on the
"normal" root file system, e.g.

# mkdir /initrd

The name is not relevant. More details can be found on the pivot_root(2)
man page.

If the root file system is created during the boot procedure (i.e. if
you're building an install floppy), the root file system creation
procedure should create the /initrd directory.

If initrd will not be mounted in some cases, its content is still
accessible if the following device has been created:

# mknod /dev/initrd b 1 250
# chmod 400 /dev/initrd

Second, the kernel has to be compiled with RAM disk support and with
support for the initial RAM disk enabled. Also, at least all components
needed to execute programs from initrd (e.g. executable format and file
system) must be compiled into the kernel.

Third, you have to create the RAM disk image. This is done by creating a
file system on a block device, copying files to it as needed, and then
copying the content of the block device to the initrd file. With recent
kernels, at least three types of devices are suitable for that:

- a floppy disk (works everywhere but it's painfully slow)
- a RAM disk (fast, but allocates physical memory)
- a loopback device (the most elegant solution)

We'll describe the loopback device method:

1) make sure loopback block devices are configured into the kernel
2) create an empty file system of the appropriate size, e.g.
# dd if=/dev/zero of=initrd bs=300k count=1
# mke2fs -F -m0 initrd
(if space is critical, you may want to use the Minix FS instead of Ext2)
3) mount the file system, e.g.
# mount -t ext2 -o loop initrd /mnt
4) create the console device:
# mkdir /mnt/dev
# mknod /mnt/dev/console c 5 1
5) copy all the files that are needed to properly use the initrd
environment. Don't forget the most important file, /sbin/init
Note that /sbin/init's permissions must include "x" (execute).
6) correct operation the initrd environment can frequently be tested
even without rebooting with the command
# chroot /mnt /sbin/init
This is of course limited to initrds that do not interfere with the
general system state (e.g. by reconfiguring network interfaces,
overwriting mounted devices, trying to start already running demons,
etc. Note however that it is usually possible to use pivot_root in
such a chroot'ed initrd environment.)
7) unmount the file system
# umount /mnt
8) the initrd is now in the file "initrd". Optionally, it can now be
compressed
# gzip -9 initrd

For experimenting with initrd, you may want to take a rescue floppy and
only add a symbolic link from /sbin/init to /bin/sh. Alternatively, you
can try the experimental newlib environment [2] to create a small
initrd.

Finally, you have to boot the kernel and load initrd. Almost all Linux
boot loaders support initrd. Since the boot process is still compatible
with an older mechanism, the following boot command line parameters
have to be given:

root=/dev/ram0 rw

(rw is only necessary if writing to the initrd file system.)

With LOADLIN, you simply execute

LOADLIN initrd=
e.g. LOADLIN C:\LINUX\BZIMAGE initrd=C:\LINUX\INITRD.GZ root=/dev/ram0 rw

With LILO, you add the option INITRD= to either the global section
or to the section of the respective kernel in /etc/lilo.conf, and pass
the options using APPEND, e.g.

image = /bzImage
initrd = /boot/initrd.gz
append = "root=/dev/ram0 rw"

and run /sbin/lilo

For other boot loaders, please refer to the respective documentation.

Now you can boot and enjoy using initrd.

Changing the root device
------------------------

When finished with its duties, init typically changes the root device
and proceeds with starting the Linux system on the "real" root device.

The procedure involves the following steps:
- mounting the new root file system
- turning it into the root file system
- removing all accesses to the old (initrd) root file system
- unmounting the initrd file system and de-allocating the RAM disk

Mounting the new root file system is easy: it just needs to be mounted on
a directory under the current root. Example:

# mkdir /new-root
# mount -o ro /dev/hda1 /new-root

The root change is accomplished with the pivot_root system call, which
is also available via the pivot_root utility (see pivot_root(8) man
page; pivot_root is distributed with util-linux version 2.10h or higher
[3]). pivot_root moves the current root to a directory under the new
root, and puts the new root at its place. The directory for the old root
must exist before calling pivot_root. Example:

# cd /new-root
# mkdir initrd
# pivot_root . initrd

Now, the init process may still access the old root via its
executable, shared libraries, standard input/output/error, and its
current root directory. All these references are dropped by the
following command:

# exec chroot . what-follows dev/console 2>&1

Where what-follows is a program under the new root, e.g. /sbin/init
If the new root file system will be used with udev and has no valid
/dev directory, udev must be initialized before invoking chroot in order
to provide /dev/console.

Note: implementation details of pivot_root may change with time. In order
to ensure compatibility, the following points should be observed:

- before calling pivot_root, the current directory of the invoking
process should point to the new root directory
- use . as the first argument, and the _relative_ path of the directory
for the old root as the second argument
- a chroot program must be available under the old and the new root
- chroot to the new root afterwards
- use relative paths for dev/console in the exec command

Now, the initrd can be unmounted and the memory allocated by the RAM
disk can be freed:

# umount /initrd
# blockdev --flushbufs /dev/ram0

It is also possible to use initrd with an NFS-mounted root, see the
pivot_root(8) man page for details.

Usage scenarios
---------------
The main motivation for implementing initrd was to allow for modular
kernel configuration at system installation. The procedure would work
as follows:

1) system boots from floppy or other media with a minimal kernel
(e.g. support for RAM disks, initrd, a.out, and the Ext2 FS) and
loads initrd
2) /sbin/init determines what is needed to (1) mount the "real" root FS
(i.e. device type, device drivers, file system) and (2) the
distribution media (e.g. CD-ROM, network, tape, ...). This can be
done by asking the user, by auto-probing, or by using a hybrid
approach.
3) /sbin/init loads the necessary kernel modules
4) /sbin/init creates and populates the root file system (this doesn't
have to be a very usable system yet)
5) /sbin/init invokes pivot_root to change the root file system and
execs - via chroot - a program that continues the installation
6) the boot loader is installed
7) the boot loader is configured to load an initrd with the set of
modules that was used to bring up the system (e.g. /initrd can be
modified, then unmounted, and finally, the image is written from
/dev/ram0 or /dev/rd/0 to a file)
8) now the system is bootable and additional installation tasks can be
performed

The key role of initrd here is to re-use the configuration data during
normal system operation without requiring the use of a bloated "generic"
kernel or re-compiling or re-linking the kernel.

A second scenario is for installations where Linux runs on systems with
different hardware configurations in a single administrative domain. In
such cases, it is desirable to generate only a small set of kernels
(ideally only one) and to keep the system-specific part of configuration
information as small as possible. In this case, a common initrd could be
generated with all the necessary modules. Then, only /sbin/init or a file
read by it would have to be different.

A third scenario are more convenient recovery disks, because information
like the location of the root FS partition doesn't have to be provided at
boot time, but the system loaded from initrd can invoke a user-friendly
dialog and it can also perform some sanity checks (or even some form of
auto-detection).

Last not least, CD-ROM distributors may use it for better installation
from CD, e.g. by using a boot floppy and bootstrapping a bigger RAM disk
via initrd from CD; or by booting via a loader like LOADLIN or directly
from the CD-ROM, and loading the RAM disk from CD without need of
floppies.

Obsolete root change mechanism
------------------------------

The following mechanism was used before the introduction of pivot_root.
Current kernels still support it, but you should _not_ rely on its
continued availability.

It works by mounting the "real" root device (i.e. the one set with rdev
in the kernel image or with root=... at the boot command line) as the
root file system when linuxrc exits. The initrd file system is then
unmounted, or, if it is still busy, moved to a directory /initrd, if
such a directory exists on the new root file system.

In order to use this mechanism, you do not have to specify the boot
command options root, init, or rw. (If specified, they will affect
the real root file system, not the initrd environment.)

If /proc is mounted, the "real" root device can be changed from within
linuxrc by writing the number of the new root FS device to the special
file /proc/sys/kernel/real-root-dev, e.g.

# echo 0x301 >/proc/sys/kernel/real-root-dev

Note that the mechanism is incompatible with NFS and similar file
systems.

This old, deprecated mechanism is commonly called "change_root", while
the new, supported mechanism is called "pivot_root".


Mixed change_root and pivot_root mechanism
------------------------------------------

In case you did not want to use root=/dev/ram0 to trig the pivot_root mechanism,
you may create both /linuxrc and /sbin/init in your initrd image.

/linuxrc would contain only the following:

#! /bin/sh
mount -n -t proc proc /proc
echo 0x0100 >/proc/sys/kernel/real-root-dev
umount -n /proc

Once linuxrc exited, the kernel would mount again your initrd as root,
this time executing /sbin/init. Again, it would be duty of this init
to build the right environment (maybe using the root= device passed on
the cmdline) before the final execution of the real /sbin/init.

Resources
---------
[1] Almesberger, Werner; "Booting Linux: The History and the Future"
http://www.almesberger.net/cv/papers/ols2k-9.ps.gz
[2] newlib package (experimental), with initrd example
http://sources.redhat.com/newlib/
[3] Brouwer, Andries; "util-linux: Miscellaneous utilities for Linux"
ftp://ftp.win.tue.nl/pub/linux-local/utils/util-linux/
 http://lxr.linux.no/linux/Documentation/initrd.txt
 http://wiki.kldp.org/wiki.php/LinuxdocSgml/Initrd-TRANS

About initrd

The Linux kernel, as in other Unix systems, is loaded into memory during the operating system boot process, and remains resident throughout the operation of the system, as do application programs ? software which executes in "userspace", under the control of the kernel.

In order to minimise the amount of code which is loaded into memory, and for maximum modularity, the Linux kernel omits much code that is necessary to load the operating system. Some of this code is located in modules loaded into kernelspace, known as kernel modules; the rest is userspace applications.

In order to make a boot system which can apply to a range of hardware, or which can be loaded from a range of different media including virtual, transient media such as that provided a network connection, it is frequently necessary for the kernel to access userspace code and perhaps kernel modules, in order to gain the data and routines necessary to access the main data store. This is not necessarily the case with every particular configuration, but is frequently the case.

The initrd boot system has been the primary solution of this problem, for as long as anyone can remember [1], although recently developed initramfs introduced in kernel 2.6 makes significant improvements. [2]

In the initrd system, files to be accessed by the kernel at boot-time are stored on a ramdisk, whose contents are found in a filesystem which has been made on either a loop mounted file, or more historically, on a small mountable device such as a floppy disk, and is usually between 1.4 MB and 4 MB in size. The loop-mount filesystem is compressed with gzip. The location of this ramdisk image is provided to the kernel at load-time, by the boot loader (usually either LILO or GRUB).

The initrd system employs several "kludges" and has some drawbacks, from the point of view of an administrator. Creating or editing a ramdisk filesystem image requires root privileges, in order to loop-mount the filesystem image to make changes, and/or to initialise a filesystem structure (format) on the virtual-drive. Furthermore, the filesystem used on the ramdisk image may be one that would not be used in the kernel otherwise, and that the code to access the filesystem must be programmed into the kernel, meaning that it cannot be later unloaded in the fashion which is possible where code is loaded from kernel modules.

Ramdisks are a fixed size ? so they typically take up more space than is needed, and yet they limit the amount of space which is available as working space once the system is booted. In fact the initrd approach disallows unloading of part of the memory used by the initrd at all, without rebooting.

However, despite these issues, since the system has had almost universal application for some years, it is still in wide use.

Initramfs in comparison with initrd

In comparison, initramfs is a more convenient and simpler system for administrators to manage than the previous ramdisk-based system, since the external code housed in the initrd can easily be edited with non-privileged operations, and since less indirection is involved: there is no need to make a virtual drive, format the virtual drive, and provide the kernel with filesystem capabilities beyond the minimal requirements to read a compressed cpio archive.[1]

Since the original ramdisk-based system was popularised, a newer more flexible, ram-based filesystem known as tmpfs or shmfs, has become a standard component of the kernel. This system is in many ways much more flexible and efficient than the original fixed-size ramdisk: it does not require formatting, and uses as little or as much memory as is required to hold the data.

Another similar system, ramfs has been used, giving the initramfs system its name, and currently users may choose which particular dynamic RAM filesystem to use.[2]

Along with the code for tmpfs, which is used in the kernel of nearly all Linux configurations, the only requirement to make a suitable virtual drive for booting to, was to add the ability to decompress an archive of files (the kernel developers chose to use the cpio archive format). The decompressed files are stored to a tmpfs-like filesystem. This system is known as initramfs.[3]

Uses

As well as providing for loading of necessary code preparatory to booting code from a fixed disk, a ramdisk (either initrd or initramfs) may be useful as a rescue disk, for use in applying security updates, backing up files, conducting forensics or debugging hardware problems, or to obviate a hard disk, perhaps in order to provide network-stored OS images, or in order to boot a slow medium such as a CD-ROM.

Many Linux distributions ship a single, generic kernel image that is intended to boot as wide a variety of hardware as possible. The drivers included with this generic kernel image must be modular, as it is not possible to statically compile everything into the one kernel without making it too large to boot from computers with limited memory or from lower-capacity media like floppy disks.

This then raises the problem of detecting and loading the modules necessary to mount the root file system at boot time (or, for that matter, deducing where or what the root file system is).

To further complicate matters, the root file system may be on a software RAID volume, LVM, a network file system of some sort (NFS is common on diskless computers) or on an encrypted partition. All of these require special preparations to mount.

End-user implementation

The kernel image and initrd image must both be stored somewhere accessible by the boot firmware of the computer or the Linux bootloader. On PCs, this is usually:

    * The root file system itself
    * A small ext2 or FAT-formatted partition on a local disk (a boot partition)
    * A TFTP server (on systems that can boot from Ethernet)

The bootloader will load the kernel and initrd image into memory and then start the kernel, passing in the memory address of the initrd. At the end of its boot sequence, the kernel tries to determine the format of the image from its first few blocks of data:

    * If the image is a (optionally gzip-compressed) file system image, then it will be made available as a special block device (/dev/ram), which is then mounted as the initial root file system. The driver for that file system must be compiled statically into the kernel. Many distributions originally used compressed ext2 file systems as initrd images. Others (including Debian 3.1) used cramfs in order to boot on memory-limited systems, since the cramfs image can be mounted in-place without requiring extra space for decompression.

    Once the initial root file system is up, the kernel executes "/linuxrc" as its first process. When it exits, the kernel assumes that "/linuxrc" has mounted the real root file system and executes "/sbin/init" to begin the normal user-space boot process.

    * If the image is a gzip-compressed cpio archive, it will be unpacked by the kernel in an intermediate step into a tmpfs, which then becomes the initial root file system. This scheme has been dubbed initramfs and is available on Linux 2.6.13 onwards. It has the advantage of not requiring an intermediate file system to be compiled into the kernel.

    On an initramfs, the kernel executes "/init" as its first process. "/init" is not expected to exit.

Some Linux distributions will generate a customized initrd image which contains only whatever is necessary to boot that particular computer, such as ATA, SCSI and filesystem kernel modules. These typically embed the location and type of the root file system.

Other distributions (such as Fedora and Ubuntu) generate a more generic initrd image. These start only with the device name of the root file system (or its UUID) and must discover everything else at boot time. In this case, a complex cascade of tasks must be performed to get the root file system mounted:

    * Any hardware drivers that the boot process depends on must be loaded. A common arrangement is to pack kernel modules common storage devices onto the initrd and then invoke a hotplug agent to pull in modules matching the computer's detected hardware.
    * If the root file system is on NFS:
          o Bring up the primary network interface.
          o Invoke a DHCP client, with which it can obtain a DHCP lease.
          o Extract the address of the NFS server from the lease.
          o Mount the NFS share.
    * If the root file system appears to be on a software RAID device, there is no way of knowing which devices the RAID volume spans; the standard MD utilities must be invoked to scan all available block devices and bring the required one online.
    * If the root file system appears to be on a logical volume, the LVM utilities must be invoked to scan for and activate the volume group containing it.
    * If the root file system is on an encrypted block device:
          o Invoke a helper script to prompt the user to type in a passphrase and/or insert a hardware token (such as a smart card or a USB security dongle).
          o Create a decryption target with the device mapper.
    * Perform any maintenance tasks which cannot otherwise be safely done on a mounted root file system.
    * Mount the root file system read-only.

The final root file system cannot simply be mounted over "/", since that would make the scripts and tools on the initial root file system inaccessible for any final cleanup tasks. Instead, it is mounted at a temporary mount point and rotated into place with pivot_root(8) (which was introduced specifically for this purpose). This leaves the initial root file system at a mount point (such as "/initrd") where normal boot scripts can later unmount it to free up memory held by the initrd.

Most initial root file systems implement "/linuxrc" or "/init" as a shell script and thus include a minimal shell (usually /bin/ash) along with some essential user-space utilities (usually the BusyBox toolkit). To further save space, the shell, utilities and their supporting libraries are typically compiled with space optimizations enabled (such as with gcc's "-Os" flag) and linked against a stripped-down version of the C library such as dietlibc or klibc.

Some distributions (notably, SUSE Linux and Ubuntu) further use the initrd to paint a bootsplash animation onto the display early on in the boot process.

SELInux (Security-Enhanced Linux) What?

A. SELInux (Security-Enhanced Linux) What? Two. What is SELinux policy? Three. Check SELinux installation Four. SELinux the default settings - / etc / sysconfig / selinux 5 SELinux service settings - setenforce 6. SELinux service settings - chcon 7 SELinux service settings - setsebool Eight. How to replace your policy? Nine. SELinux LOG 10 Audit2allow 11 avc: denied 12 References or URL

A. SELInux (Security-Enhanced Linux) What?

What is SELinux U.S. National boanguk (US National Security Agency), sleep in the open source community rilrijeuhan security-hardened version of Linux (including code) structure as a Linux security module (Linux Security Modules (LSM) framework) mandatory access to the Linux kernel using Control (Mandatory Access Control - MAC) is to implement. From Fedora Core3 began to be applied by default, the current most modern Linux distributions are supported. SELinux to help the understanding of the DAC, MAC and I'll tell you a little bit. Standard Linux security Discretionary Access Control - DAC model. In a DAC model, file and resource decisions that only the object (objects) of the user (user id) and the ownership (ownership) is done according to the. Each user and program run by that user is assigned to the self-object has complete discretion over. In these circumstances, a malicious general or root user (for example, setuid and setgid) that runs through the faulty software can do anything you want with the given object, there is no way to thwart the system security policy to be implemented across the way do not have. MAC under SELinux, on the other hand, all subjects (subjects - users, programs, and processes) and objects (files, devices) for a local permit (granular permissions) can give. Unnecessary part of the application, except for features only the necessary permissions is able to secure grants. SELinux all the principals (users, programs, and processes) and objects (files and devices) to grant each other will allow. Therefore, one application to work properly, the program may be granted to secure the necessary permissions.

Two. What is SELinux policy?

SELinux policies to users, programs, processes and behavior of these devices, including the subject files and the entire system, ie, for every subject and object access permissions (access permissions) tells the package containing the. Policy package is available in Fedora strict, targeted There are two ways. Fedora Core SELinux policy strict policy of applying because of a variety of users many of the problems causes due to the (regular users using SELinux in order to high-level expertise is required), current RHEL4 a more relaxed policy packages targeted poicy installed is built upon. The only question is often part of targeted policy takes precedence and the other operates in the same way as the standard Linux security policy is applied to. Currently, targeted policy in the dhcpd, httpd (apache.te), named, nscd, ntpd, portmap, snmpd, squid, and syslogd daemon to manage for. this daemon on a policy file / etc / selinux / targeted / src / policy / domains / program can be found at:

Three. Check SELinux installation

Make sure you are using SELinux, how to determine the security context in a way that can be seen. Files, users, processes, and to determine the context, a new option when using-Z can be found. ls-lZ / etc / selinux -Rw-r - r - root root system_u: object_r: selinux_config_t config drwxr-xr-x root root system_u: object_r: selinux_config_t targeted The-Z option to show the security context using this result through the "system_u" user, "object_r" role, "selinux_config_t" type can be found. Comparison of these in the context of SELinux policies to allow or deny it, if possible, so check the SELinux context is being used. In addition to process each file and user security context can be found as shown below. root @ example # PS axZ | grep squid user_u: system_r: squid_t 3912? Ss 0:00 squid-D user_u: system_r: squid_t 3 915? S 9:10 (squid)-D user_u: system_r: squid_t 3,916? Ss 0:01 (unlinkd) root @ example # id uid = 0 (root) gid = 0 (root) groups = 0 (root), 1 (bin), 2 (daemon), 3 (sys), 4 (adm), 6 (disk), 10 (wheel) context = root: system_r: unconfined_t If RedHat's SELinux packages using the command sestatus-v with the current state of SELinux can be found below. [Root @ ns selinux] # sestatus-v SELinux status: enabled SELinuxfs mount: / selinux Current mode: enforcing Mode from config file: enforcing Policy version: 18 Policy from config file: targeted Policy booleans: allow_ypbind active dhcpd_disable_trans inactive httpd_disable_trans active httpd_enable_cgi active httpd_enable_homedirs active httpd_ssi_exec active httpd_tty_comm inactive httpd_unified active mysqld_disable_trans inactive named_disable_trans active named_write_master_zonesactive nscd_disable_trans active ntpd_disable_trans inactive portmap_disable_trans inactive postgresql_disable_transinactive snmpd_disable_trans inactive squid_disable_trans inactive syslogd_disable_trans inactive winbind_disable_trans inactive ypbind_disable_trans inactive Process contexts: Current context: root: system_r: unconfined_t Init context: user_u: system_r: unconfined_t / Sbin / mingetty user_u: system_r: unconfined_t / Usr / sbin / sshd user_u: system_r: unconfined_t File contexts: Controlling term: root: object_r: devpts_t / Etc / passwd root: object_r: etc_t / Etc / shadow system_u: object_r: shadow_t / Bin / bash system_u: object_r: shell_exec_t / Bin / login system_u: object_r: bin_t / Bin / sh system_u: object_r: bin_t -> system_u: object_r: shell_exec_t / Sbin / agetty system_u: object_r: sbin_t / Sbin / init system_u: object_r: init_exec_t / Sbin / mingetty system_u: object_r: sbin_t / Usr / sbin / sshd system_u: object_r: sbin_t / Lib/libc.so.6 system_u: object_r: lib_t -> system_u: object_r: shlib_t / Lib/ld-linux.so.2 system_u: object_r: lib_t -> system_u: object_r: ld_so_t [Root @ ns selinux] #

Four. SELinux the default settings - / etc / sysconfig / selinux

How to set the distribution is different for each service. Red Hat and Fedora distributions I've tested the file / etc / sysconfig / selinux SELinux on the set of available modes. / Etc / sysconfig / selinux file's contents # This file controls the state of SELinux on the system. # SELINUX = can take one of these three values: # Enforcing - SELinux security policy is enforced. # Permissive - SELinux prints warnings instead of enforcing. # Disabled - SELinux is fully disabled. SELINUX = enforcing # SELINUXTYPE = type of policy in use. Possible values ​​are: # Targeted - Only targeted network daemons are protected. # Strict - Full SELinux protection. SELINUXTYPE = targeted There are two parts of this file set the status of SELINUX (enforcing, permissive, disabled), set up and activate the part of security policy (strict or targeted one of them) are part of SELINUXTYPE to determine. Disabled - If you do not want SELinux security controls used to select disalbed options. disalbed set off the security control system to disable the security policy. permissive - This selection is a denial of service to be notified of the message. When set to permissive conditions for data and program logs, once you assign a name, but does not use security policy. If you are new to the SELinux permissive state from scratch, without having to fully activate this feature, first enable this policy, the general system operations and determine what impact any time if you can be a good starting point.However, sometimes a security warning when the warning options not covered by warnings that the target-detection error (false positive) or a warning that the target does not detect the error (false negative), so the possibility also has to be taken. enforcing - SELinux enforcing To enable the option to completely let. enforcing an additional option for system security, all security policies (for example, users who do not have permission to access a particular file or program to deny) is used. SELinux is fully executed and no effect, interfere with normal operations of the system can do without getting that select this option if you want to own.

5 SELinux service settings - setenforce

SELinux to be of service when you need to change the status directly / etc / sysconfig / selinux file, SELINUX = enforcing, or modifying SELINUX = permissive as to how to change the command setenforce able to use it, but  Is "Setenforce 0" as the command to be falling, and the same results as the SELINUX = permissive, "setenforce 1" means the enforcing mode.SELinux on the system completely if you do not want to use the file / etc / sysconfig / selinux SELINUX = disabled at system boot time or set as a boot loader and boot parameter selinux = 0 if he is. (Grub if you're using grub, press e to edit mode on the screen after the kernel line went down at the end selinux = 0 and ESC, and when the boot is pressing b.) sentenforce command sysadm_r have permission to perform; To do this, newrole command, or, or, su - to root for user switching, you can get permission sysadm_r automatically.

6. SELinux service settings - chcon

You need to change the SELinux security context of the case, the command can use chcon. Create a directory while you are using Apache even though obviously if you get errors like this http_user_content_t as its DocumentRoot can solve haejum is applied to. chcon-R-t httpd_user_content_t / home / user account / public_html

7 SELinux service settings - setsebool

S [root @ ns ~] # cat / etc / selinux / targeted / booleans allow_ypbind = 1 dhcpd_disable_trans = 0 httpd_disable_trans = 1 httpd_enable_cgi = 1 httpd_enable_homedirs = 1 httpd_ssi_exec = 1 httpd_tty_comm = 0 httpd_unified = 1 mysqld_disable_trans = 0 named_disable_trans = 1 named_write_master_zones = 1 nscd_disable_trans = 1 ntpd_disable_trans = 0 portmap_disable_trans = 0 postgresql_disable_trans = 0 snmpd_disable_trans = 0 squid_disable_trans = 0 syslogd_disable_trans = 0 winbind_disable_trans = 0 ypbind_disable_trans = 0 RHEL4 SELinux settings, the transition of a system representing the file / etc / selinux / targeted / booleans file. In the file, each entry in system-config-securitylevel of the application or setsebool a command using the changes are capable setsebools When using the-P option if you do not use the configuration file does not change the current settings have changed, but the-P option, as If you use / etc / selinux / targeted / booleans file to change the content of the system is applied ributinghuedo.

Eight. How to replace your policy?

The issue is not taken lightly baejeongchaek replacement. Test equipment for research purposes (test machine) to try a new policy in addition, the production system (production system) before replacing it with a different policy on the status should seriously consider. Replacement operation is simple. This is a very safe way, but try first primary in the test system is desirable. One way to use system-config-securitylevel to change the policy, rename (relabel) is to set the file system to. Manual procedures are as follows: A. / Etc / selinux / config and edit the type of policy change in SELINUXTYPE = policyname. Two. Be able to return to reboot to make sure that, SELINUX = permissive mode is set . When you do this, SELinux commissioned under the correct policy, but, if the incorrect file naming context (labeling) and would like to log in. If you have a problem. Three. sysadm_r with the role as root to relabel the file system (relabel): id-Z root: sysadm_r: sysadm_t fixfiles relabel  option-l / path / to / logfile log to standard output by using the visible and, option-o / path / to / file by using the Review (checked) or rename (relabel ed) a list of all files can be saved. Four. Reboot the system. under the new policy, restart all system processes started in the proper context and policy changes should reveal all the problems caused by. 5 sestatus-v command to check the changes took effect. Permissive mode on the new system started up, avc: denied messages in / var / log / messages to check. Under the new policy, they ensure that the system is running without problems indicates the problems that need to be addressed. 6. Under the new policy, when you return the system satisfactorily, SELINUX = enforcing to grant execute permissions to the change. real-time to enable the enforcing reboot or run setenforce 1 to.

Nine. SELinux LOG

SSELinux of the log in / var / log / messages like this appear. kernel: audit (1114070701.193:0): avc: denied {read} for pid = 24216 exe = / usr / libexec / mysqld name = mysql dev = cciss/c0d0p6 ino = 16408 scontext = user_u: system_r: mysqld_t tcontext = root: object_r: var_lib_t tclass = dir This log can be interpreted as follows. - Read the request was denied. - PID 24216, a process that tries to read - The process / usr / libexec / mysqld is - / Dev/cciss/c0d0p6 is working in - Inode is the 16408. - The process of the SELinux context user_u: system_r: mysqld_t is - Tcontext = root: object_r: var_lib_t: This file is the file attempts to read twelve var_lib_t type is a file owned by root. SELinux LOG meaning of each item audit (timestamp) - This field Message from States that it's an SELinux audit and that it WAS logged at time timestamp (in seconds since Jan. 1st, one thousand nine hundred seventy). AVC - This WAS Message from the SELinux Access vector cache. Pretty much every message you are likely to see is from this cache. denied | accepted - This field Oppenheim Whether the Action WAS denied or accepted. You may see logs of accepted messages in some cases (like reloading the policy). {Read | write | unlink | ... } - This Shows the type of field that WAS Attempted Action, such as File are Reading, Writing, unlinking, loading policy, etc. for pid =  - This is the Process ID that the Action Attempted. exe =  - This is the path to the Executable that the Process Started. name =  - This is the name of the target on which the Action Attempted WAS. dev =  - This is the Device File is Located on which the target. I no =  - This is the target of the Action of the inode. scontext =  - This is the Process's Security context. This contains user, role, and type. tcontext = - This is the target of the Security context of this Action, for example, the File, Directory, etc. tclass =  - This is the class of the target object, such as Directory, File, Device node, or something else.

10 Audit2allow

Useful tool for policy author / usr/bin/audit2allow, which is the / var / log / messages for avc messages that can be used by SELinux allows translation rules. If you can not use yum install policycoreutils policycoreutils package, so as part of the installation is possible. audit2allow command can be input in three ways. The default standard input (stdin) is If you use the-i option to / var / log / messages can be read from the input using the-d option if you can read input from the output of dmesg.

11 avc: denied

The message that the current run SELinux policy does not allow the behavior of the application because On this there are various reasons. first, an application attempting to access is one of the files found there may be misnamed. See ten thousand and one AVC message, if a particular file, ls-alZ / path / to / file file name to the current reference by performing (current label) See investigate. If you see if it is wrong, restorecon-v / path / to / file, try. Very many associated with a file is denied (denials) If circumstances exist, fixfiles relabel or perform repeatedly in order to relabel the directory path with the-R option to restorecon you may want to perform. At other times, reject (denials ) phenomenon to be rejected by the policy can be generated by changing the settings in the program. For example, if you change port 8800 to Apache, and security policy, apache.te, also related to a change becomes necessary. For detailed information on policy creation, if you want a list of external links (External Link List) see.

12 References or URL

Home of the SELinux Project - http://www.nsa.gov/selinux/ The Un-Official SELinux FAQ - http://www.crypt.gen.nz/selinux/faq.html SELinux link Zoo - http://www.crypt.gen.nz/selinux/links.html Ubuntu Linux SELinux Pages - https://www.ubuntulinux.org/wiki/SELinux 2005.8 Sys Admin Magazine - http://www.samag.com/documents/s=9820/sam0508a/0508a.htm NSA SELinux FAQ - http://www.nsa.gov/selinux/info/faq.cfm SELinux Community page - http://selinux.sourceforge.net Unofficial FAQ - http://www.crypt.gen.nz/selinux/faq.html Writing SE Linux policy HOWTO - https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=21266 Getting Started with SE Linux HOWTO: the New SE Linux (Debian) -https://sourceforge.net/docman/display_doc.php?docid=20372&group_id=21266