Red Hat ENTERPRISE LINUX 4 - SELINUX GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 6.Tools for Manipulating and Analyzing SELinuxAn administrator’s job may include analyzing and possibly manipulating the SELinux policy, as wellas doing performance analysis and tuning. This chapter discusses analysis and tuning.For policy manipulation, you may wish to support a new daemon or discover and fix a problem, asdiscussed in Chapter 8 Customizing and Writing Policy. One early step to writing policy is analyzingexisting policy so that you understand how it works. One example of this is given in Section 2.9.1 HowTo Backtrack a Rule, where a macro is analyzed through the process of backtracking to the source ofa set of rules.While some effective policy analysis can be done using standard command line text manipulationtools, sophisticated policy analysis requires stronger tools. The simpler targeted policy consists ofmore than 20,000 concatenated lines in policy.conf, which is derived from more than 150 macrosand thousands of lines of TE rules and file context settings, all interacting in very complex ways. Toolssuch as apol are designed specifically for doing analysis of SELinux policy. This chapter discussesthese tools, which are part of the setools package. In addition to the GUI analysis tools seaudit andapol, several command line tools that are useful for gathering information and statistics are explained.Analysis is also necessary when doing performance tuning. Due to the real and potential workloadimposed by the AVC system, you may have some situations where being able to manipulate how thisworks is useful to improving performance. This chapter presents some methods to tune your SELinuxinstallation.In order to use these applications, you need both the setools and setools-gui packagesinstalled. The other packages you need come with the SELinux installation: libselinux andpolicycoreutils.TipWhen you are running a privileged application over ssh, meaning an application that requires you tohave root privileges, you must use the -Y option. This option enables trusted X11 forwarding:ssh -Y root@host.example.comThe configuration requiring this is enabled by default and is new to Red Hat Enterprise Linux 4.6.1. Information Gathering ToolsThese tools are command line tools, providing formatted output. They are harder to use as part ofcommand line piping, but they provide gathered and well formatted information quickly.avcstatThis provides a short output of the access vector cache statistics since boot. You can watch thestatistics in real time by specifying a time interval in seconds. This provides updated statisticssince the initial output. The statistics file used is /selinux/avc/cache_stats, and you canspecify a different cache file with the -f /path/to/file. For example, this might be usefulfor reviewing saved snapshots of /selinux/avc/cache_stats.avcstatlookups hits misses allocs reclaims frees194658175 194645272 12903 12903 880 12402