Ensuring an SELinux rule is never allowed

It is possible to include statements in the SELinux policy that ensure that a particular access vector cannot be allowed, not even by enhancing the SELinux policy later. This is done with the neverallow statement.

How to do it…

To include the neverallow statements in the policy and enforce them, go through the following steps:

1. In /etc/selinux/semanage.conf, enable support for the neverallow statements by setting the expand-check variable to 1:

   expand-check=1

2. Create an SELinux policy in which the access vectors that should be explicitly forbidden are listed. Consider the following instance:

   neverallow user_t system_mail_t:process transition;

3. Build and load the policy.

4. Generate another policy that will allow the statement and attempt to load it:

   ~$ semodule -i mytest.pp
   libsepol.check_assertion_helper:  neverallow violated by allow user_t system_mail_t:process { transition };
   libsemanage.semanage_expand_sandbox: Expand module failed
   semodule: Failed!
   

How it...