[ SRE_ARENA ]
← BACK TO ROADMAP
COMPLIANCE & OS HARDENING

Compliance is Not Security, But It's Mandatory.

Visualization: 1. Discretionary vs. Mandatory Access Control (SELinux)
DOWNLOADING CONCEPT: 1. DISCRETIONARY VS. MANDATORY ACCESS CONTROL (SELINUX)...
  • ↳Standard Linux file permissions (rwxr-xr-x) use Discretionary Access Control (DAC).
  • ↳The owner dictates access, and the root user can bypass all checks.
SELinux
  • ↳and AppArmor provide Mandatory Access Control (MAC).
  • ↳The system administrator dictates policy, and even root must obey it.
The SELinux Flow
  • ↳1. A hacker exploits a vulnerability in Nginx.
  • ↳The Nginx worker process happens to be running as root.
  • ↳2. The hacker tries to read /etc/shadow to crack passwords.
  • ↳3. The Kernel intercepts the read() system call and checks SELinux labels.
  • ↳4. Nginx has the label httpd_t.
  • ↳The file has the label shadow_t.
  • ↳5. The policy explicitly denies httpd_t from reading shadow_t.
  • ↳The Kernel blocks the request, despite Nginx running as root.
  • ↳*Never disable SELinux (setenforce 0).
  • ↳If an app is blocked, use audit2allow to generate the correct policy.*
▲ LIVE INCIDENTYou deployed a new static site to Nginx in /var/www/html/newsite, but Nginx returns 403 Forbidden. File permissions are 755 and owned by nginx.
sre@arena:~/compliance-hardening
sre@arena:~$ ls -Z /var/www/html/newsite/index.html