►
From YouTube: The Level Up Hour (E63) | SELinux Redux
Description
Are you new to containers, Kubernetes, or Red Hat OpenShift? Are you a sysadmin looking to broaden your horizons? Or maybe you're a Fedora user who wants to gain more expertise beyond Linux? Whatever hat you wear, don't miss our next Level Up Hour live stream for hands-on demos and problem-solving to expand your open source know-how, learn about the hottest topics in cloud-native application development and leave with the knowledge you need to level up your career.
Want to learn more?
[Add info about featured topics as needed]
Try Red Hat OpenShift: https://red.ht/3uYcuhU
Follow us:
Randy Russell https://red.ht/rrr-linkedin
Scott McBrien https://twitter.com/stabby_mc
Jaafar Chraibi https://twitter.com/ChraibiJc
OpenShift https://twitter.com/openshift
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
What is the Level Up Hour?
Every other Wednesday at 9am ET we stream live demos on how Red Hat Enterprise Linux (RHEL) users and admins can benefit their organizations and improve their careers by learning how to use containers, Kubernetes, and Red Hat OpenShift.
Learn more at https://red.ht/leveluphour
Level Up Hour on GitHub https://github.com/level-up-hour/
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
OpenShift on redhat.com https://red.ht/3uXIbaQ
OpenShift on github https://github.com/openshift/
#RedHat #OpenShift #RHEL #tluh
A
B
B
B
So
we
have
a
great
episode.
I
think
today
on
a
topic
that
is
sort
of
a
back
to
the
future,
and
I
just
want
to
remind
everybody
like
subscribe
and
share.
So
everybody
knows
that
we're
out
here
doing
level
up
hour.
Today
we
are
going
to
talk
about
sc,
linux
and
containers,
and
the
reason
that
this
strikes
me
as
a
back
to
the
future
kind
of
thing
is
that
for
those
with
a
long
memory,
you
might
recall
that
openshift
began
as
an
se.
Linux
trick
right.
B
Well,
but
the
actual
before
before
we
actually
did
it
as
a
container
orchestration
thing
using
kubernetes.
It
actually
was
an
se
linux
built
product
very,
very
early
in
its
in
its
life
cycle
way
way
back
years,
but
now
we
have
a
different
interest
in
it
right,
but
it's
the
same
interest
that
we
have
in
general
with
sc
linux.
A
A
So
se,
linux
was
added
to
the
red
hat
enterprise:
linux
distribution
as
one
of
the
standard
features
in
red
hat
enterprise,
linux
4.
So
it's
been
with
us
for
a
long
long
time
and
its
goal
is
to
change
how
processes
and
users
interact
with
resources
on
the
system
and
there's
a
whole
like
vast
policy
rule
set
that
determines
those
rules
of
engagement
between
processes
and
users
or
processes
and
files
or
files
and
users
or
ports
and
files
or
ports
and
users
and
ports
and
processes.
A
B
B
The
scripts
that
you
had
lovingly
curated,
you
know
for
years
under
previous
releases,
might
not
have
worked,
applications
might
not
have
worked,
but
you
know
it's
because
it
really
fundamentally
alters,
as
you
said,
everything
files
processes,
users.
You
know
what
users
the
processes
are
running
under
what
files
a
particular
user
running,
a
particular
process
can
run
under.
So
it's
it's
very
all-encompassing,
but
it's
always
possible
to
be
the
executioner
and
just
come
in
and
go
no
to
sc
linux
right.
A
But
we
don't
do
that
anymore.
In
fact,
many
of
your
rel
systems,
if
you've
just
installed
one
and
are
running
it,
probably
have
it
on
and
enforcing
by
default,
and
you
don't
notice
it
because
of
all
the
improvements
we've
made
to
the
policies
and
the
interactions
between
things
over
the
intervening
15
years.
B
Well,
okay,
maybe
it's
not
a
good
idea
for
this
to
run
under
this
user
or
for
you
know
this
particular
process
to
have
this
degree
of
file
system
access,
so
I
think
that
it
in
a
sense
it
was
the
rising
tide
that
lifted
all
boats
and
we
rose
the
tide
a
bit
by
trying
to
address
it
and
make
it
a
lot
more.
Just
it
works
it's
transparent,
it's
not
a
problem,
but
I
think
it
also
affected
people's
behavior.
B
A
Well,
it
certainly
interacts
with
with
containers,
in
fact,
there's
a
several
se.
Linux
types
that
go
along
with
containers
and
we'll
see
a
little
bit
about
that
today
and
then
we
also
added
some
tools,
specifically
one
that
we'll
take
a
look
at
in
the
second
demo,
to
create
custom
policy
modules
to
insert
into
your
policy
for
specific
container
contexts.
A
A
So
it's
enabled
it's
using
a
policy
called
the
targeted
policy,
which
is
the
normal
one
that
we
use
for
red
hat
enterprise
linux
these
days,
and
so
it's
it's
there
and
if
you've
not
seen
sc
linux
before
one
of
the
other
red
hat
enterprise,
linux
shows
touches
on
some
of
the
basics.
For
it,
and
just
the
rules
of
the
road
are
put
things
where
we
expect
and
know
that
sc
linux
could
be
stopping
things
so
nowhere
to
look
to
troubleshoot
all
right.
A
So
I
think
those
are
the
two,
the
two
first
like
pillars
of
working
with
se
linux,
so
I'm
just
gonna
become
a
normal
user
and
we're
gonna
do
some
rootless
container
stuff.
So
I'm
just
gonna
build
a
container
real
quick
and
to
make
my
life
a
little
bit
easier,
I'm
going
to
copy
and
paste
from
a
document.
A
A
A
And
so,
if,
if
you're,
seeing
podman
for
the
first
time,
we're
running
container
in
detached
mode,
we're
assigning
a
port
assignment
to
it.
So
connections
that
come
in
on
port
8080
of
the
host
will
be
redirected
to
the
container's
port
80,
which
is
where
we
have
apache
sitting
there
and
listening
thanks
to
our
configuration
inside
the
container
earlier.
A
A
So
these
processes
that
are
running
in
my
container
right
here,
what's
interesting
about
them,
is
with
this
z
output.
I
get
this
field
of
selinux
stuff
right
and
this
field
of
messy
linux
stuff
tells
me
the
contexts
that
this
program
is
running
with
earlier.
We
took
a
look
at
what
the
essie
linux
policy
was.
It
was
the
targeted
policy,
and
the
targeted
policy
typically
looks
at
the
third
field
in
this
set
of
contexts.
A
So
just
for
reference,
the
fields
of
this
output
are
the
user
field.
That's
the
system!
U
the
role!
That's
the
system,
r,
the
type
so
we're
at
container
underscore
init
underscore
t
the
sensitivity,
and
then
this
last
bit
is
called
the
category
and
this
is
assigned
in
a
container.
Whereas
if
we
look
at
other
processes
on
the
system,.
A
A
The
other
one
has
right,
because,
according
to
the
system,
if
we're
just
to
look
at
like
basic
linux
process
management,
these
are
running
httpd
processes
and
we
would
look
at
things
like
ownerships
or
permissions
to
determine
their
access
to
things.
But
thanks
to
se
linux,
we
now
have
this
additional
dimension
of
control
and
the
way
that
we
identify
individual
containers
to
control
them
even
more
tightly.
B
A
A
There
are
several
flavors
of
universal
base
image
and
we've
talked
about
that
on
a
previous
show
and
we
can
use
the
ubi
standard
image
like
we're
doing
here,
which
is
fine
like
clearly.
My
process
is
running.
It's
listing
on
the
right
ports,
the
differential
between
ubi
standard
and
ubi
init
is
if
instead,
we
had
more
complex
processes
running
so
maybe
we
had
a
database
running
in
this,
this
container
2..
A
So
there
we
can't
just
start
up
apache
as
the
base
process.
When
the
container
starts.
We
need
to
start
up
both
apache
and
the
database,
and
that
would
be
a
reason
why
you
would
want
to
use
the
ubi
init
flavor,
which
includes
a
full
system
d
implementation.
So
you
can
write
the
unit
files
and
start
services
and
control
like
the
the
order
in
which
they
start,
and
things
like
that.
A
A
A
A
A
A
A
So
what
this
rule
that
I've
highlighted
says
is
that
container
and
knit
t
type
processes
are
allowed
attach
to
unix
datagram
sockets
right,
so
they
can
open
or
use
udp-based
network
connections
and
when
they
attach
to
those
udp,
sockets
they're
allowed
to
accept
append,
bind
connect,
create
get
attribute,
get
opt.
I
o
control,
lock
them
memory
map
for
them
and
a
variety
of
other
parameters
right.
A
So
what
we're
looking
at
is
whether
it's
an
allow
or
deny
the
context
that
this
rule
applies
to
the
function,
that
this
rule
controls,
unix
d-gram
socket
and
then,
when
a
process
of
this
type
tries
to
do
an
activity
of
this
type.
Here
are
the
actual
things
it's
allowed
to
do.
So
we
can
see
maybe
a
little
bit
smaller
list.
A
Oh,
like
here's
one
where
it's
allowed
only
one
one
activity.
So
if
a
container
init
t
attaches
to
or
tries
to
use
pure,
I
don't
know
system
call,
maybe
it
can
only
receive
v.
That's
the
only
thing
it's
allowed
to
do
so
again.
We
don't
want
to
kind
of
jump
into
the
craziness
of
essenex
rule
manufacturing.
A
B
A
The
problem
is,
I
think,
a
lot
of
people
work
in
an
environment
where
they
don't
have
selinux,
either
they're
on
another
linux
or
they're,
using
tools
to
build
and
manage
their
containers
that
don't
interact
with
selinux,
and
so
they
take
this
from
their
development
environment
or,
from
this
other
thing
that
they're
working
with
and
they
send
it
to
a
repository
and
somebody
on
rel
downloads
it
from
the
repository
and
tries
to
run
it.
It
all
comes
crashing
down
on
them.
So.
A
C
C
Yeah,
what
I'd
like
to
mention
at
some
point
is
that
we
do
provide
also
this
kind
of
out
of
the
box
features
for
openshift
in
terms
of
selinux
rules
and
configurations,
but
yeah,
let's,
let's
skip
that
a
little
a
little
bit
later
for
a
bit
later
and
apologies
for
for
the
people
on
the
stream.
I
I'm
a
bit
sick
today,
so
it's
better.
If
I
don't
show
my
camera.
A
Here
we're
going
to
invoke
our
container
a
little
bit
differently
number
one
you'll
notice
that
I'm
doing
it
as
root,
so
we're
not
going
to
be
running
rootless
for
this
example,
because
doing
things
like
adding
your
own
policy
is
something
that
requires
root
ability
and
rather
than
trying
to
figure
out
like
how
to
play
between
the
root
account
and
user
accounts.
I
just
said
well
for
time's
sake
and
simplicity.
A
Let's
cut
out
the
middleman
there
all
right,
so
I'm
going
to
run
my
container
we're
going
to
store
its
container
id
that
gets
returned
when
podman
invokes
it
into
this
variable
called
container,
but
this
time,
instead
of
just
running
the
apache
container
and
binding
it
to
a
port.
We
also
do
a
couple
of
additional
things.
A
So
here
it
is,
and
if
I
do
a
podman
ps
right,
there's
my
running
container
agitated
visvestraria,
whatever
that
is
and
so
we're
running,
except
it's
not
operating
the
way
that
one
would
expect
so
notice.
There
were
no
errors
on
the
on
the
command
line
there
right
it's
running
and
everything
looks
fine
until
you
try
to
work
with
it
a
little
bit
closely.
A
A
So.
Let
me
go
out
of
my
container
here
and
the
first
thing
remember
way
back
at
the
beginning
of
the
episode,
I
said
the
two
main
things
for
sc
linux
is
put
things
where
we
expect
and
know
where
to
look
to
troubleshoot.
If
there
are
problems
all
right.
So
here's
here's
the
problem.
We
didn't
put
things
where
we
expect.
Why
are
containers
accessing
things
in
varspool?
Why
are
containers
accessing
things
in
someone's
home
directory?
That's
unusual
activity
for
a
container
to
be
given
access
to,
and
so
the
default
selinux
rules
are
like
nope.
Sorry,
buddy!
A
A
A
All
right,
so
we
see
some
error
messages
from
beforehand,
but
I'm
going
to
put
some
white
space
in
there,
so
we
can
get
some
fresh
data
and
I'm
going
to
go
back
into
my
container
image.
I'm
going
to
do
that.
Ls
again,
so
I
said
ls
home
which,
according
to
the
container
invocation,
should
work.
But
we
know
it's
not
working
and
no
and
then
we're
going
to.
A
Sc
linux
error
messages
right,
and
so
it's
telling
me
that
right
here
this
is
probably
the
most
interesting
message
straight
to
the
point.
Se
linux
is
preventing
our
container
from
read
access
on
the
direct
reversible,
and
then
it
gives
us
some
stuff
that
we
can
do
if
we
wanted
to
resolve
that
with
audit
to
allow.
B
What
I
wanted
to
do
with
some
fun?
Okay,
but
yes,
scott,
is
absolutely
correct.
This
is
if
it
was
something
you
shouldn't
do
it,
you
wouldn't
be
able
to
do
it,
but
you
will
need
to
do
this
sometimes,
and
it's
for
exactly
the
kind
of
thing
that
scott's
doing
now,
where
it's
a
diagnostic
thing.
Well,
okay,
let
me
let
me
confirm
that
it
is
in
fact
what
I'm
thinking
it
is
which
is
sc
linux.
This
is
the
easiest
way
to
do
that.
A
A
A
A
And
when
we
turn
it
back
to
a
forcing
mode-
and
we
expect,
if
I
try
to
look
at
home,
it
fails
again
right.
So
we've
we've
diagnosed
that
sc
linux
is
really
a
problem.
We
saw
the
error
messages
that
were
happening
in
context.
Then,
when
we
turned
it
off,
all
of
our
problems
were
magically
solved.
We
turned
it
back
on
oh
gosh.
A
It
was
terrible
again
and
at
this
point
the
less
seasoned
administrator
would
be
like
I'll
just
turn
it
off
right,
but
we're
not
less
seasoned
administrators,
we're
people
that
know
what
we're
doing
so.
What
we're
going
to
do
instead
is
we're
going
to
create
a
policy
extension
that
will
allow
our
container
to
actually
do
the
things
that
we
intended
to
do
so.
A
A
B
A
A
A
And
that
results
in
this
container
json,
which
is
like
all
these
definitions
around
what
this
thing
does
but
what's
important
about
it,
is
that
in
this
definition,
it's
going
to
have
information
like
the
fact
that
this
container
was
given
pass-through
access
to
home,
and
this
container
was
given
read,
write
pass-through
access
to
var
spool,
that's
what's
in
this
json
that
we
care
about.
Also
it's
going
to
have
things
like
what
it
was
attached
to
and
some
other
stuff.
A
A
All
right,
so
it
has
successfully
done
that,
and
it
says
in
the
output
here,
like
hey,
don't
forget
to
load
your
extension
into
the
sms
policy
and
then
also
when
you
start
your
container
you're
going
to
have
to
tell
the
container
that
it
needs
to
identify
itself
as
this
special
kind
of
process
so
that
it
is
able
to
be
covered
under
this
rule,
set
that
you
just
created
all
right.
So
let's
go
ahead
and
do
what
it
suggests,
which
is
insert
our
policy
extension.
A
B
A
A
A
A
A
There
we
go
so
this
one
right
here
got
added
by
adding
that
yuditsa
generated
extension,
and
it
says
that
when
things
are
running
as
scot
app
process
type,
they
are
allowed
access
to
user
home
directory
type
files
and
when
they
access
user
home
directory
type
files,
they're
allowed
to
do
these
things
and
notice
they're
allowed
to
get
attributes.
So
they
can
do
things
like
an
ls.
A
A
A
Same
thing,
scott
app
process,
type
running
processes
are
given
access
to
var
spool
type
directories
and
then
here's
the
things
they
can
do
add
name
means
that
they
can
do
things
like
create
new
files
in
there
there's
also
a
write
right,
so
I
can
actually
like
put
the
data
in
the
directory
in
my
files.
So
that's
that's
what
we
did
with
that
yuditsa
thing
right,
so
super
complex
se,
linux
became
magically
delicious
by
having
a
container
tool.
B
Well,
I'm
liking
the
pizza
yeah.
I
like
the
story,
that's
a
great
name,
so
jafar
see,
if
you
can,
you
know,
drag
yourself
out
of
your
sick
bed
for
a
moment
and
share
with
us.
Are
these
things
that,
when
you're
working
within
the
openshift
environment
are
things
that
you
have
to
consider
there
as
well
or
are
they
things
that
in
a
sense,
openshift
is
already
taken
care
of
for
you.
C
So
I
think
we
stephanie
has
shared
the
link
on
on
the
chat,
and
so
one
one
of
the
great
things
is
that
all
of
those
sc
linux
rules
are
already
also
implemented
for
openshift,
for
containers
to
be
able
to
run
safely
and
not
be
able
to
have
too
many
capabilities
when
running
on
openshift
by
default.
So
we
have
what
we
call
security
context
constraints
which
are
ways
for
us
to
determine.
C
Basically
what
containers
are
allowed
to
do
by
default.
So
we
do
provide
different
types
of
what
we
call
sccs
and
I'm
going
to
share
a
link
to
the
openshift
documentation.
That
explains
basically
what
it
does
and
so
yeah
it
does
provide.
All
of
those
very
rich
policies-
and
they
are
already
implemented
for
openshift
and
as
an
administrator,
you
can
change
the
attributions
and
define
new
security,
con
sccs
and
such
things,
but
they
do
also
control
control
what
happens
with
the
ac
linux
contacts,
etc.
So
that's
one.
B
C
A
So,
as
jafar
pointed
out
like,
if
you're
using
openshift,
all
this
stuff,
just
kind
of
happens
and
just
like,
we
manage
the
policies
for
rel
in
in
a
way
that,
like
mostly
the
services
that
work
with
religious
kind
of
work,
same
thing
is
true
for
open
shift
right.
So
we
take
care
of
that
automatically
in
that
product.
A
So
when
you
have
to
get
into
the
bowels
of
of
se,
linux
is
when
you're
using
rel
natively
as
a
container
host,
and
you
have
more
eclectic
container
activities
that
you're
trying
to
do
where
you're
trying
to
pass
through
host
accesses
or
host
resources
to
your
container.
That's
where
you're
going
to
probably
run
into
some
bumpiness
and
have
to
use
some
of
these
sc
linux,
troublesheen
techniques
that
we
talked
about
today
and.
C
B
A
A
Not
really
can
ruthless
users
do
things
when
they
invoke
their
containers
to
to
make
sure
that
they
have
the
right
policy
set.
I
was
having
trouble
with
that.
So
it's
not
to
say
that
it
can't
be
done,
I'm
just
not
smart
enough
to
do
it
apparently
or
it's
something
that
needs
to
be
further
enhanced.
There's
a
couple
weird
things
that
happen
with
rootless
containers.
A
I
know
the
podman
team
specifically
has
been
working
just
feverishly
to
try
and
resolve
some
of
those
things
around
things
like
namespaces
and
some
other
stuff
and
they're
getting
better
they're
getting
incrementally
better,
and
you
should
see
some
changes
in
podman
4,
which
will
ease
some
of
those,
not
all
of
them
and
there's
actually
a
a
doc
one.
Second,
let
me
look
it
up
that.
A
A
A
There
we
go
so
these
are
the
the
things
that
he
knows
about
that.
Don't
quite
work
the
way
one
would
like
that
they're
going
to
work
on
resolving,
but
so,
when
you're
doing
rootless
stuff.
I
always
if
I
run
into
weird
problems,
I
always
check
here
first
to
make
sure
that
it's
not
a
known,
weird
problem,
because
because
yeah
there's
still
some
weirdness
there.
B
Yep,
well
maybe
that's
something
we
can
consider
in
a
future
episode,
but
for
now,
unless
we
have
some
additional
questions
or
comments,
we
had
a
lot
of
comments
today,
fewer
fewer
fewer
questions,
more
comments,
like
said,
enforce:
zero!
No,
no,
I
say
doesn't
look
like
we
have
any
more,
so
I
think
with
that
we
can
call
it
another
one.
So
everybody
please
do
remember
to
like
subscribe
and
share.