For example, ones that implement these guidelines? https://madaidans-insecurities.github.io/guides/linux-hardening.html
Alternatively, packages for Fedora that would set this up automatically
For example, ones that implement these guidelines? https://madaidans-insecurities.github.io/guides/linux-hardening.html
Alternatively, packages for Fedora that would set this up automatically
Ah gotcha, just asking because I’ve never used it before. Good to know that Gentoo supports hardening it
Gentoo lets you do basically whatever you want. The whole idea of it is that you make all the decisions in your system, as opposed to how most distros impose their developers’ choices.
Yep! Gotta love the flexibility of it
Really fasttracked my Linux learning experience too. If you’re starting out Linux and are predisposed to masochism like I am, using Gentoo as your first distro really catalysed my understanding of Linux (at the cost of a week’s worth of crying and self-loathing lmao).
Totally, props on taking it on as your first distro! Haha, yeah a week of pain sounds about right. My last Gentoo setup took an entire month (off and on), but I was doing something crazy (Qubes-like, every application in its own Gentoo VM, strict SELinux on host and guests)… ended up ditching that because I got comfortable enough with SELinux to write stronger policies for everything important, which is good enough for me.
I had the benefit of using other distros before trying Gentoo, so my first attempt at it wasn’t so bad (but still took two full days). It’s definitely taught me way more than any other distro, including Arch (although Arch was a very good stepping stone). I don’t think I could go back to anything else at this point
What a coincidence, I’m trying to learn SELinux too! Any tips?
Awesome! Here are a few things that come to mind:
Make sure you have some aliases/functions for common operations:
audit2allow -a
to view audit violations (or-d
for dmesg audits)-r
to add a requires statement for module constructionrestorecon -Rv
to recursively apply file contexts from policy (or-FRv
to also apply user context)rm -f /var/log/audit/audit.log.*; >/var/log/audit/audit.log
to clear audit logschown -R user:user PATH; chcon -R -u user_u PATH
to recursively change labels to usersemanage fcontext -a -t TYPE PATH -s $SEUSER
to add a custom file context to the policysemanage fcontext -a -t "user_secrets_t" "/home/[^/]+/.secrets(/.*)?" -s user_u
.fc
file, but in any case a custom policy is needed to create custom typessemanage fcontext -d PATH
to remove a custom file contextsemanage fcontext -lC
to list custom file contextssemodule -DB
to rebuild policy with all dontaudit rules disabledaudit2allow
doesn’t show anythingsemodule -B
to rebuild policy (with dontaudit rules)semodule -i MODULE.pp
to install a modulesemodule -r MODULE
to remove a moduleAlso a few scripts for policy creation and management are essential. There are two basic approaches to policy creation: modules and policy modules.
Modules: can be used to modify AVC rules and are pretty simple
Policy modules: can do anything, but are complicated, and the tools for creating them are mostly based on Red Hat.
Creating a new type:
Creating a new application type:
If your target application is interpreted, you’ll need to write a custom C program that launches the interpreter in a specific context, then write your policy around that application. For example, you should execv something like this:
/usr/bin/runcon -u user_u -t my_script_t /bin/bash PROG
.Thanks! I’ll be copypasting all of these to my notes haha
np! Hope it helps; it’s a big pain but I do think it’s pretty secure if configured correctly