Resetting SELinux to default

[Mahmood Naderan]

Hi,
What is the safest method to reset SELinux to its default configuration without reinstalling the operating system?



Regards,
Mahmood

[Thomas Mueller]

Post by Mahmood Naderan
Hi,
What is the safest method to reset SELinux to its default
configuration without reinstalling the operating system?

For filesystem labels:

touch /./autorelabel
reboot/

/
/

/For  modules I don't know how it could be achieved./

/Some time semanage supports --local/

/semanage ports --list --local/

/semanage booleans --list --local/

/Which should list what was modified from default policy.
/

/- Thomas
/

[Thomas Cameron]

Post by Mahmood Naderan
Hi,
What is the safest method to reset SELinux to its default configuration
without reinstalling the operating system?

Generally, when you make changes to SELinux, a file with the extension
.local is created under /etc/selinux.

So to see all the changes that have been made, you can do

find /etc/selinux -name "*.local"

Then you can read those files and back out any changes which have been
made.

On my system, for instance, I have a file:

/etc/selinux/targeted/contexts/files/file_contexts.local

I just tested, and the booleans.local no longer seems to be created... I
know there used to be a booleans.local file created when you ran
setsebool -P. Has that gone away?

Thomas
_______________________________________________
selinux mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to selinux-***@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinu

[Thomas Cameron]

Post by Thomas Cameron
I just tested, and the booleans.local no longer seems to be created... I
know there used to be a booleans.local file created when you ran
setsebool -P. Has that gone away?

Never mind, sorry - it's under /var/lib/selinux now.

So you can see changes to file contexts and booleans under:

/var/lib/selinux

Look for files with the extension .local. You can read them and see what
changes have been made if you want to back them out and get a "default
config."

TC
_______________________________________________
selinux mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to selinux-***@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/***@list

[Mahmood Naderan]

touch /.autorelabel
reboot

OK I did that. What is the effect then?! How can I find out that something has been reset?

So to see all the changes that have been made, you can do
find /etc/selinux -name "*.local"

Yes I can see this for example
[***@sn snadmin]# cat /etc/selinux/targeted/active/booleans.local
# This file is auto-generated by libsemanage
# Do not edit directly.

httpd_unified=1
httpd_read_user_content=1
ftpd_full_access=1
httpd_can_connect_ftp=1
httpd_can_network_connect=1
httpd_can_sendmail=1




Regards,
Mahmood

[Thomas Mueller]

Post by Mahmood Naderan

Post by Thomas Mueller
touch /./autorelabel
reboot/

OK I did that. What is the effect then?! How can I find out that something has been reset?

Good question. the relabling is handled by the  /etc/rc.d/rc.sysinit
script and calls

/sbin/fixfiles -F restore >/dev/null 2>&1

so if anything would have been printed, it is redirected to /dev/null.

- Thomas

[Thomas Cameron]

Post by Mahmood Naderan

Post by Thomas Mueller
touch /./autorelabel
reboot/

OK I did that. What is the effect then?! How can I find out that something has been reset?

Relabeling only sets the filesystem to the defined SELinux labels. It
doesn't change any custom file contexts you've set up.

You can also run:

semanage fcontext -C -l

to see what local file context changes have been made, as well as
looking at the file_contexts.local file.

Then you can remove them if you want to go back to the default config
that came with the distro.

Post by Mahmood Naderan

Post by Thomas Mueller
So to see all the changes that have been made, you can do
find /etc/selinux -name "*.local"

Yes I can see this for example
# This file is auto-generated by libsemanage
# Do not edit directly.
httpd_unified=1
httpd_read_user_content=1
ftpd_full_access=1
httpd_can_connect_ftp=1
httpd_can_network_connect=1
httpd_can_sendmail=1

Well, if you want to go back to the default config from when you first
installed the OS, you could back those out. For instance,

setsebool -P httpd_unified 0

will revert the boolean back to the default setting.

But before we go any further, what are you actually trying to
accomplish? Any fcontext changes or boolean changes made were probably
made for a reason. It might make more sense to discover what's been
changed and then determine if that change is appropriate.

As an aside, I learned today that you can also run:

semanage boolean -C -l

to see all the changed booleans. So you can look at the *.local files,
or use the command line. Thanks for asking this question, it made me
learn something new. :-)

Once you've determined what changed, you could change them back to
"factory default" if that's what you're trying to do.

I do recommend that you see what's been changed, then determine if it
makes sense to change it back rather than blindly setting the system
back to defaults.

Thomas
_______________________________________________
selinux mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to selinux-***@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/s

[Mahmood Naderan]

/sbin/fixfiles -F restore >/dev/null 2>&1 
so if anything would have been printed, it is redirected to /dev/null.
But before we go any further, what are you actually trying to
accomplish?

Earlier I asked about an SELinux prevention message. After running "touch /.autorelabel && reboot" I don't see such messages in the log and ALSO it seems that the problem has been solved! Because I can upload files on the server via browser.
So, I wonder if there are still some messages that are redirected to /dev/null!!


Regards,
Mahmood

[Thomas Cameron]

Post by Mahmood Naderan

/sbin/fixfiles -F restore >/dev/null 2>&1 
so if anything would have been printed, it is redirected to /dev/null.
But before we go any further, what are you actually trying to
accomplish?

Earlier I asked about an SELinux prevention message. After running
"touch /.autorelabel && reboot" I don't see such messages in the log and
ALSO it seems that the problem has been solved! Because I can upload
files on the server via browser.

Heh - are you sure you understand the implications of being able to
upload random files to your computer?

Post by Mahmood Naderan
So, I wonder if there are still some messages that are redirected to
/dev/null

Any SELinux messages should be stored in /var/log/audit/audit.log

You can use tools like ausearch and aureport to see what's going on.

TC
_______________________________________________
selinux mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to selinux-***@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/***@lists

[Thomas Mueller]

Post by Thomas Cameron

Post by Mahmood Naderan

Post by Thomas Mueller
/sbin/fixfiles -F restore >/dev/null 2>&1
so if anything would have been printed, it is redirected to /dev/null.
But before we go any further, what are you actually trying to
accomplish?

Earlier I asked about an SELinux prevention message. After running
"touch /.autorelabel && reboot" I don't see such messages in the log and
ALSO it seems that the problem has been solved! Because I can upload
files on the server via browser.

Heh - are you sure you understand the implications of being able to
upload random files to your computer?

maybe he added the semange fcontext for the one folder that needs rw
rights and autorelable fixed all the other  issues that arose because of
moving files from $HOME to /var/www.

- Thomas
_______________________________________________
selinux mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to selinux-***@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/a

[Thomas Cameron]

Post by Thomas Mueller
maybe he added the semange fcontext for the one folder that needs rw
rights and autorelable fixed all the other  issues that arose because of
moving files from $HOME to /var/www.

Absolutely possible! That is literally the most common issue I hear
about from the field, is folks moving instead of copying.

This may be a case of having used a sledgehammer to fix it. :-)
_______________________________________________
selinux mailing list -- ***@lists.fedoraproject.org
To unsubscribe send an email to selinux-***@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archi