Hello and welcome back.
And this movie we're going to be taking a look at how a targeted policy allows interactions between
System objects.
Let's begin.
So here in my server if I go through an acid search dash dash allow this is going to show me all the
rows that S.E. Linux uses to allow interactions between objects in different domains.
If I do a word count on this you can see this over one hundred thousand barrels and used by the targeted
policy.
If you were still confused and I suspect that you are that's OK.
We're going to do a quick example to help clarify the significance of allow rules for this I'm going
to be needing the Apache web server.
So let's go ahead and install that type TTP the That's control C and kill this process with kill 9 9
7 4 6 and retry
after the install.
I'm going to sys CTO status if I can spell it correctly.
Right.
TBD to check if my service is active and running it isn't.
So let's go ahead and stop this.
I'm going to change that to start and if I check again.
So my service is up and running and I can track the default document through it with a long list.
So that's a dub dub dub height t ever.
There's nothing in this folder of the moment.
So I can go ahead and say touch.
Let's call the file index dot height see all.
If I now go through indeed and SC Linux please turn on this file you can see the type.
I'm also going to pass dash e Zi and grab for height.
TTP D
Hi.
D O K so this is the domain of the Apache demon and this is the type of the file I won't shoot right
down the street values so we can check them against the allowed.
I'm just gonna go ahead and cover this.
So that's copy that controls you see and well a few seconds ago I did as a search dash dash.
Allow me to list all the allow rows on this server.
This time I'm going to grab for this domain so let's clear my screen and enter.
We've still got a lot of lines so let's streamline the results further with grep high GDP D.
On the score t let's clear my screen and redo that so we can see things very clearly.
These are the rows that currently controls the interaction between the objects and these two domains.
So presently the demons in this domain are allowed to access the files the folders and the shortcuts
in this domain.
We can go through and test this where w gets something to hide TTP Blacklock block local host for Slash
index dark hide t email.
And if I do a list then you can see that we were able to successfully download the file because the
web server demon the Apache demon is allowed to interact with the domain of the requested file.
Let's change the context of the index file with change icon dash T.
I'm going to call this new domain admin home on the score t on var dub dub dub high female index at
height t email.
We can verify with a long list and let's just cover the path and paste it.
Here we go for now.
Attempts to retry the W get command this time it fails because the file is now inside a domain.
If it's not allowed to interact with the Apache process so this was a rather simplistic example.
I want you to go back and watch this movie again until you understand the demonstrations and the concept
of allow grows.
Well that's all for now.
Thank you for your time and I hope to see you in the next lesson.