This training is dedicated for students who want to learn in detail how SELinux really works internally, how to manage the existing policy and how to create their own SELinux policy modules from scratch for unsecured local and network services.
Together with participants, we will go through attack vectors and malicious methods used by attackers directly in confrontation with SELinux. We focus a lot on detailed analysis of Linux security subsystems, hardening options and confinement of local and network services in battle with modern exploitation techniques.
- Discretionary Access Control vs Mandatory Access Control
- Analysis and practical use of Linux exploits and vulnerabilities:
- Invalid read, use-after-free, out-of-bound, stack and heap overflows, null pointer dereference, syscall hooking and more.
- SELinux Architecture and capabilities:
- Flask Model
- Mandatory Access Control
- Rule Based Access Control
- Multi Level Security
- Multi Category Security
- domains and types, security context, domain and type transition
- Analysis of targeted SELinux policy:
- Source code analysis of RHEL / CentOS and Tresys Reference Policy
- Types and modes
- Filesystem locations
- SELinux module development and compilation:
- Syntax of m4 language
- Classes oraz objects
- Interfaces and macros
- Aliases, types and attributes
- Boolean variables definition
- Compilation modes
- Access Vector Cache.
- Tools used to create and modify SELinux policy.
- Creating SELinux users and roles.
- Using SELinux for hardening Docker containers and cloud environments.
- SELinux against exploits → real security use-cases.
- SELinux tips and tricks.
- Final project.
2 days (9:00am - 5:00pm)
Who should attend
- Linux Engineers
- System Architects
- DevOps and DevSecOps team members
- Security Engineers
TRAINER: Leszek Miś
Leszek Miś is the Founder of Defensive Security, Principal Trainer & IT Security Architect. Recently he was a VP, Head of Cyber Security in Collective Sense - a Machine Learning Network Security Startup from the U.S. where he was responsible for product security research, strategy, business analysis & technical feature implementation and recommendation. He has over 13 years of experience in the IT security market supporting the world’s largest customers in terms of exfiltration simulations and penetration tests, infrastructure hardening and general Open Source and IT Security consultancy services. In addition, he has 11 years of experience in teaching and transferring a deep technical knowledge and his own experience. He has trained 600+ students with the highest rank. He is an IT Security Architect with offensive love and a recognized expert in the enterprise OSS market.
If interested in dedicated, closed training for your Linux Security team let us know. We love delivering on-site training sessions!