I assume that Selinux defaults, based on the documentation, mandate that basically all port operations would be blocked and logged as AVCs.

I have an SELinux enforcing enabled VM, created with Centos7 out of the box.

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             mls
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31

However, I can start a webserver and bind it to port 1.

[vagrant@localhost ~]$ sudo python -m SimpleHTTPServer 1
Serving HTTP on port 1 ...

Im assuming SElinux , with enforcing and no other modifications on a fresh OS would actually limit access to these sorts of operations (im just using port 1 as an example of how severe a security violation can be, because in general I thought at least low number ports would be blocked by default via selinux).

  • 1
    I'd additionally note that root privileges are required to bind on ports under 1024, and you're specifically running the python script under sudo. – Jeff Schaller Jul 9 '19 at 20:05
  • Yes, thats part of the point :) I want to test that SELinux is preventing me, even as root, from doing the wrong thing. – jayunit100 Jul 10 '19 at 13:39
  • @jayunit100 Then you would need to configure confined users (without transition to administrative/unconfined domains), which would prevent users gaining privileges even with sudo (confined root). – sebasth Jul 10 '19 at 14:47

SELinux configuration (reference policy) includes unconfined types, and by default users are in unconfined domain (unconfined_t). For unconfined processes (and users who can start unconfined processes) there are very few restrictions. A process running in unconfined domain has almost the same privileges as a process would have on non-SELinux system.

The other type of domains are confined domains, which have strict rules what a process running in such domain is allowed to do.

RedHat documentation has some details and examples if you want to configure your system with confined SELinux users.

  • Interesting ,so , I ran semanage login -l and got no output. If my user is unconfined, shouldn't it still have an entry under the selinux users mapping? – jayunit100 Jul 10 '19 at 13:27
  • Actually, so, i found out that yes, default users are unconfined, just like root . [vagrant@localhost ~]$ sudo id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [vagrant@localhost ~]$ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 – jayunit100 Jul 10 '19 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.