I'm running Fedora 23. I have SELinux enabled and enforced. I know that you can change a file's labels with restorecon and chcon (and possibly other programs). This is no doubt an avenue by which a file's security can be bypassed. How can I make it so SELinux labels cannot be changed. This Gentoo documentation page says that SELinux can be used to do that, but it doesn't say how. Fedora's targeted policy provides three particular booleans:

  • secure_mode — "Do not allow transition to sysadm_t, sudo and su effected"
  • secure_mode_insmod — "Do not allow any processes to load kernel modules"
  • secure_mode_policyload — "Do not allow any processes to modify kernel SELinux policy"

Does Fedora policy come with some way to prevent user space processes from modifying SELinux labels?

  • 1
    Only if you have permission to do that. As an ordinary user, you should not have it for system files. Did you try that? What SELinux context is your user using? On which files? – Jakuje Jun 24 '16 at 6:01
  • I am the sole user, so I have an administrator account. I want to block this for root, too. How would I do that? Do I have to download the source code to Fedora's SELinux policy and modify it? Or is their some way of doing it with the compiled policy? – Melab Jun 28 '16 at 2:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.