Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Arrow up icon
GO TO TOP
SELinux Cookbook

You're reading from   SELinux Cookbook Over 70 hands-on recipes to develop fully functional policies to confine your applications and users using SELinux

Arrow left icon
Product type Paperback
Published in Sep 2014
Publisher
ISBN-13 9781783989669
Length 240 pages
Edition 1st Edition
Tools
Arrow right icon
Author (1):
Arrow left icon
Sven Vermeulen Sven Vermeulen
Author Profile Icon Sven Vermeulen
Sven Vermeulen
Arrow right icon
View More author details
Toc

Table of Contents (17) Chapters Close

SELinux Cookbook
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
1. The SELinux Development Environment FREE CHAPTER 2. Dealing with File Labels 3. Confining Web Applications 4. Creating a Desktop Application Policy 5. Creating a Server Policy 6. Setting Up Separate Roles 7. Choosing the Confinement Level 8. Debugging SELinux 9. Aligning SELinux with DAC 10. Handling SELinux-aware Applications Index

Mapping HTTP users to contexts


Applications generally run with a static context, which inhibits all privileges that are needed for the application. Even services (daemons) generally stay within their own context during the entire life cycle of the service. But, with mod_selinux, it is possible to transition the context of the web server handler (the process or thread responsible for handling a specific request) to another context based on the authenticated user. This allows the administrator to grant certain privileges to the application based on the user. When a lower-privileged user abuses a vulnerability in the web application, then the reduced privileges on the web application itself might prevent a successful exploit.

How to do it…

Through the following set of steps, we will map a web user to a specific SELinux context:

  1. Create a mapping file in which the users are listed together with their target context. For instance, to have user John's requests handled with the sensitivity s0:c0,c2...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $15.99/month. Cancel anytime
Visually different images