On This Page

Home / Stream/ Securing/ Compliance/SELinux (Enforcing Mode) Configuration

SELinux (Enforcing Mode) Configuration

SELinux (Security-Enhanced Linux) is a mandatory access control system for Linux that provides a granular level of security by defining access controls for applications, processes, and files. When SELinux is in enforcing mode, it strictly enforces security policies, which can sometimes cause conflicts with applications that aren’t explicitly allowed to perform certain actions.

If you’re unsure about SELinux and its modes, here’s some background:

  • Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) security mechanism implemented in the kernel. (Source: CentOS Wiki.)

  • SELinux defines access controls for the applications, processes, and files on a system. It uses security policies, which are a set of rules that tell SELinux what can or can’t be accessed, to enforce the access allowed by a policy. (Source: Red Hat.)

  • Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. (Source: Red Hat.)

  • SELinux has two modes, enforcing and permissive. When running in enforcing mode, SELinux enforces the SELinux policy and denies access based on SELinux policy rules. (Source: Red Hat.)

Cribl Stream and SELinux
​

To effectively integrate Cribl Stream with SELinux, consider the different policy requirements for in-stream processing and network ports.

  • Cribl Stream’s in-stream processing often involves predefined processes and files, allowing for a relatively restrictive SELinux policy.
  • Network ports might require a more permissive policy because users configure them within the UI.

Key Steps for SELinux Configuration
​

To ensure optimal integration of Cribl Stream with SELinux, begin by verifying the current SELinux status and the context of the Cribl Stream binary.

Check SELinux Status
​

Use the getenforce command to determine the current status of Security-Enhanced Linux (SELinux) on a Linux system.

getenforce

The output will be one of the following:

  • Enforcing
  • Permissive
  • Disabled

If the output is Enforcing, SELinux is enabled and enforcing policies.

Verify Cribl Stream’s SELinux Context
​

Use the command ls -Z /opt/cribl/bin/cribl to list the contents of the directory /opt/cribl/bin while displaying their SELinux security contexts.

ls -Z /opt/cribl/bin/cribl

The output should show the SELinux context for the Cribl Stream binary.

Example output:

-rwxr-xr-x. cribl cribl cribl unconfined /opt/cribl/bin/cribl

Deploy Cribl Stream directly to /opt to avoid context issues. Do not deploy Cribl Stream to a user’s home directory, or to root (/), and then move it to /opt.

Revert labels on files and directories
​

You can also use restorecon (if needed) to revert labels on files and directories to their default SELinux security context:

restorecon -R -v /opt/cribl

Check for SELinux Denials
​

Use auditd to log SELinux denials. Look for messages related to Cribl Stream in the /var/log/audit/audit.log file.

Modify SELinux Policy
​

If you encounter SELinux denials, you might need to modify the SELinux policy. There are three options ranging from least secure to most secure.

Use semanage (Less Secure):
​

This is the simplest but least secure method. It grants permissive access to the cribl_t type, allowing all operations.

Command: semanage permissive -a cribl_t

Use audit2allow (slightly more secure)
​

This method creates SELinux policy rules to permit actions that were previously denied.

To identify and address SELinux denials related to Cribl Stream, follow these steps:

  1. Find denied operations: sudo grep cribl /var/log/audit/audit.log | audit2allow -M cribl
  2. Install the generated policy: sudo semodule -i cribl.pp

Create a Custom Policy (Most Secure)
​

Use tools like secil or policycoreutils to create a custom policy tailored to Cribl Stream’s needs. This provides the highest level of security but requires more technical expertise.

Reload SELinux Policy
​

Once you’ve altered the SELinux policy using tools like semanage, audit2allow, or through custom policy creation, use this command to ensure that the new rules take effect immediately.

sudo semanage reload -a

Specific Cribl Stream Considerations
​

In addition to the general SELinux guidelines, pay close attention to these Cribl Stream–specific factors:

  • Cribl Stream Configuration: Review Cribl Stream configuration files for any settings that might conflict with SELinux restrictions.
  • Integration with Other Applications: Ensure that Cribl Stream’s interactions with other applications are compatible with their SELinux contexts and permissions.

Additional Considerations
​

In addition to the basic configuration, these factors are also important for optimal performance:

  • SELinux Booleans: Check the SELinux documentation for relevant booleans that might affect Cribl Stream’s behavior.
  • SELinux Context Labeling: Ensure files and directories used by Cribl Stream have the correct SELinux context. Use tools like restorecon to relabel files.
  • SELinux Troubleshooting Tools: Use tools like audiscan and audit2why to analyze SELinux audit logs.

SELinux Troubleshooting
​

SELinux problems usually surface when you try to start the Cribl Stream service. Users immediately receive an error like the following:

Cribl Stream fails to start

Job for cribl.service failed because the control process exited with error code.
See "systemctl status cribl.service" and "journalctl -xe" for details.

One indication that the problem is in SELinux configuration, not in the Cribl Stream service itself, is when (1) nothing has been logged in $CRIBL_HOME/log/cribl.log, and (2), when you run journalctl -xe you see errors like the following:

Errors from journalctl -xe
cribl.service: Failed to execute command: Permission denied
cribl.service: Failed at step EXEC spawning /opt/cribl/bin/cribl: Permission denied

cribl.service: Control process exited, code=exited status=203
cribl.service: Failed to execute command: No such file or directory
cribl.service: Failed at step EXEC spawning /bin/rm -f /opt/cribl/pid/cribl.pid: Permission denied

You can confirm that SELinux configuration is the issue by verifying that the Cribl Stream service is able to start up on its own. To do this, run the cribl start command.

Here are three commands that you can think of as a basic SELinux troubleshooting toolkit:

  • getenforce verifies that SELinux is enabled and enforcing policy.
  • sestatus -v shows details of the SELinux policy that’s in effect.
  • ls with the -Z or --context option shows the SELinux tags on files and/or folders. In the output, the fifth column reports the SELinux context in the form user:role:type:level.

Example Problem
​

Suppose you run ls -lZ /opt/cribl to see the SElinux context for /opt/cribl.

If the output looks like the following, there is a problem: the presence of “home” among the type part of the Linux context. In this case, user_home_t is the offending type. When the type is user_home_t or admin_home_t, SELinux will not permit the service to read, write, or execute files.

Problematic SELinux context output

$ ls -laZ /opt/cribl
total 0
drwxr-xr-x. 6 cribl cribl unconfined_u:object_r:user_home_t:s0  62 Feb 16 08:31 .
drwxr-xr-x. 3 root  root  system_u:object_r:usr_t:s0            19 Feb 16 19:54 ..
drwxr-xr-x. 2 cribl cribl unconfined_u:object_r:user_home_t:s0 202 Feb 16 08:31 bin
drwxr-xr-x. 5 cribl cribl unconfined_u:object_r:user_home_t:s0  49 Feb 16 08:20 data
drwxr-xr-x. 6 cribl cribl unconfined_u:object_r:user_home_t:s0  59 Feb 16 08:31 default
drwxr-xr-x. 3 cribl cribl unconfined_u:object_r:user_home_t:s0  22 Feb 16 08:31 thirdparty

Example Solution
​

To fix the labeling, download Cribl Stream again directly to /opt. Do not download Cribl Stream to a user’s home directory, or to root (/), and then move it to /opt - that was what caused our example problem.

Downloading Cribl Stream to /opt
curl -Lso - $(curl -s https://cdn.cribl.io/dl/latest) | sudo tar zxvf - -C /opt

A simpler option is to revert the labels using restorecon, an SELinux policy utility that’s in the policycoreutils-python-utils package.

Reverting labels with restorecon
restorecon -R -v /opt/cribl
systemctl restart cribl

Once you correct the problem, the output will look like the following. Instead of *home_t listings in the type field, this SELinux context has usr_t, a type that will satisfy SELinux’s criteria for allowing the service to read, write, and execute files.

Corrected SELinux context output

# ls -laZ /opt/cribl
total 0
drwxr-xr-x. 6 cribl cribl unconfined_u:object_r:usr_t:s0  62 Feb 16 08:31 .
drwxr-xr-x. 3 root  root  system_u:object_r:usr_t:s0      19 Feb 16 20:05 ..
drwxr-xr-x. 2 cribl cribl unconfined_u:object_r:usr_t:s0 202 Feb 16 08:31 bin
drwxr-xr-x. 5 cribl cribl unconfined_u:object_r:usr_t:s0  49 Feb 16 08:20 data
drwxr-xr-x. 6 cribl cribl unconfined_u:object_r:usr_t:s0  59 Feb 16 08:31 default
drwxr-xr-x. 3 cribl cribl unconfined_u:object_r:usr_t:s0  22 Feb 16 08:31 thirdparty