Enable SELinux

When SELinux is enabled, all system objects, including files, directories, processes, sockets, drivers, and more, are labeled with a security context. A security context consists of a user, role, type identifier, and optional sensitivity, separated by colons. For example: user:role:type:sensitivity Note User is unrelated to a Linux user, and Type is unrelated to the kind of object it is.

• A set of valid users, roles, and types is defined in the policy.
• Different objects are labeled with the same security context.
• The MAC mechanism of SELinux security policies is implemented using:
  • Type enforcement (TE)
  • Role-based access control (RBAC)
  • Refpolicy Targeted
• Types enable the policy to specify the allowed operations.

Figure : SELinux process The following procedures explains how to verify and enable SELinux and modify SELinux modes. Note By default, SELinux is enabled and configured in Enforcing mode to provide mandatory access control and strengthen platform security. During development and debugging, SELinux can be temporarily switched to Permissive mode to log policy violations without enforcing access restrictions. For production and commercial deployments, Qualcomm recommends keeping SELinux in Enforcing mode

Verify and modify SELinux mode

1. Check the current SELinux configuration of the device (Enforcing or Permissive mode):
   getenforce
   
2. If it’s set to the Enforcing mode, run the setenforce command to change the mode.
   1. Connect to the device using SSH.
   2. Change the SELinux mode by using the following commands.
      • To switch the device to Enforcing mode:
        setenforce 1
        
      • To switch the device to Permissive mode:
        setenforce 0
        
      • To recheck the current configuration of the device (Enforcing or Permissive mode):
        getenforce
        

SSH Enablement on SELinux build

SSH login enablement is allowed only for developent & debugging purpose. Ways To enable SSH login:

1. Build time enablement:
   • Create a patch on top of existing refpolicy with gen_tunable(ssh_sysadm_login, true) in refpolicy/policy/modules/services/ssh.te
   • See Customize Security Services to add patch to existing workspace.
   • Build selinux distro & Flash on the device.
   • Login to SSH
2. Runtime Enablement
   • Login to serial console
   • Run the following command:
   setsebool -P ssh_sysadm_login true
   
   • Login to SSH

Configure SELinux (Enable, disable, and switch modes)

To switch to Enforcing mode (restrictive) or Permissive mode (non-restrictive with logging), follow these steps:

1. To enable or disable SELinux:
   • To disable SELinux for the build, set DEFAULT_ENFORCING to disabled in the SELinux distro configuration file:
     meta-qcom-distro/conf/distro/include/qcom-distro-selinux.inc
     DEFAULT_ENFORCING ?= "disabled"
     
   • To enable SELinux, set DEFAULT_ENFORCING to enforcing (set by default).
   • Use policy version 35.
   • To add policies for SELinux, see upstream refpolicy.
2. Check the system status with getenforce on target. This command returns one of the three values:
   • Enforcing
   • Permissive
   • Disabled
3. To change the mode, select a mode at runtime by running setenforce with a number (this change won’t persist after reboot).

   Command	Result
   setenforce 1	Switch to Enforcing mode
   setenforce 0	Switch to Permissive mode

   1. To persist after reboot:
      1. Connect to the device using SSH. For instructions, see Qualcomm Linux Build Guide.
      2. Edit SELINUX= to one of the three supported values: enforcing, permissive, or disabled in /etc/selinux/config.
      3. Reboot the device using the following command:

         reboot
         

   2. To specify the SELinux mode in the build: Change the DEFAULT_ENFORCING build flag to one of the three supported values: enforcing, permissive, or disabled.
      meta-qcom-distro/conf/distro/include/qcom-distro-selinux.inc
      -- DEFAULT_ENFORCING = "permissive"
      ++ DEFAULT_ENFORCING = "enforcing"
      
4. The SELinux Disabled mode leaves behind many code paths that go through the SELinux framework. These code paths aren’t useful for KPI testing or verifying bugs in the SELinux framework. It also doesn’t allow any more access than Permissive mode. To disable the feature for testing, remove SELinux from DISTRO_FEATURES:
   meta-qcom-distro/conf/distro/include/qcom-distro-selinux.inc
   -- DISTRO_FEATURES:append = " selinux"
   

Next steps

• To ensure that only the verified and trusted applications are loaded during the startup process, see Enable UEFI secure boot.
• For chipset feature management and to upgrade the chipset feature packs, see Install or upgrade SoftSKU feature packs.