Configure SELinux mandatory access controls for enhanced security

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration variables
SELINUX_MODE="${1:-enforcing}"
TOTAL_STEPS=8

# Usage message
usage() {
    echo "Usage: $0 [enforcing|permissive]"
    echo "  enforcing  - SELinux blocks violations (default)"
    echo "  permissive - SELinux logs violations without blocking"
    exit 1
}

# Validate arguments
if [[ "$SELINUX_MODE" != "enforcing" && "$SELINUX_MODE" != "permissive" ]]; then
    usage
fi

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Check logs above for details.${NC}" >&2
    exit 1
}

# Set trap for cleanup on error
trap cleanup ERR

# Helper functions
log_info() {
    echo -e "${BLUE}$1${NC}"
}

log_success() {
    echo -e "${GREEN}$1${NC}"
}

log_warning() {
    echo -e "${YELLOW}$1${NC}"
}

log_error() {
    echo -e "${RED}$1${NC}" >&2
}

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Auto-detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_UPGRADE="apt upgrade -y"
                PKG_INSTALL="apt install -y"
                SELINUX_PACKAGES="selinux-basics selinux-policy-default auditd policycoreutils-python-utils setools-console"
                NEEDS_ACTIVATION=true
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf check-update || true"
                PKG_UPGRADE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                SELINUX_PACKAGES="selinux-policy selinux-policy-targeted policycoreutils-python-utils setools-console audit"
                NEEDS_ACTIVATION=false
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum check-update || true"
                PKG_UPGRADE="yum update -y"
                PKG_INSTALL="yum install -y"
                SELINUX_PACKAGES="selinux-policy selinux-policy-targeted policycoreutils-python-utils setools-console audit"
                NEEDS_ACTIVATION=false
                ;;
            *)
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
}

# Update system packages
update_system() {
    log_info "[1/$TOTAL_STEPS] Updating system packages..."
    $PKG_UPDATE
    $PKG_UPGRADE
    log_success "System packages updated successfully"
}

# Install SELinux packages
install_selinux() {
    log_info "[2/$TOTAL_STEPS] Installing SELinux packages..."
    $PKG_INSTALL $SELINUX_PACKAGES
    log_success "SELinux packages installed successfully"
}

# Activate SELinux (Ubuntu/Debian only)
activate_selinux() {
    if [[ "$NEEDS_ACTIVATION" == "true" ]]; then
        log_info "[3/$TOTAL_STEPS] Activating SELinux for Ubuntu/Debian..."
        selinux-activate
        selinux-config-enforcing
        log_success "SELinux activation configured"
    else
        log_info "[3/$TOTAL_STEPS] SELinux activation not needed for this distribution"
    fi
}

# Configure SELinux main configuration
configure_selinux() {
    log_info "[4/$TOTAL_STEPS] Configuring SELinux main configuration..."
    
    # Backup existing config if it exists
    if [[ -f /etc/selinux/config ]]; then
        cp /etc/selinux/config /etc/selinux/config.backup
    fi
    
    # Create SELinux configuration
    cat > /etc/selinux/config << EOF
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=$SELINUX_MODE
# SELINUXTYPE= can take one of these values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted
EOF
    
    chmod 644 /etc/selinux/config
    log_success "SELinux configuration file updated"
}

# Enable and start audit daemon
configure_audit() {
    log_info "[5/$TOTAL_STEPS] Configuring audit daemon..."
    systemctl enable auditd
    systemctl start auditd
    log_success "Audit daemon enabled and started"
}

# Configure basic SELinux policies
configure_policies() {
    log_info "[6/$TOTAL_STEPS] Configuring basic SELinux policies..."
    
    # Only configure policies if SELinux is already active
    if command -v setsebool &> /dev/null && sestatus &> /dev/null; then
        # Web server policies
        setsebool -P httpd_can_network_connect 1 2>/dev/null || log_warning "Could not set httpd_can_network_connect"
        setsebool -P httpd_can_network_connect_db 1 2>/dev/null || log_warning "Could not set httpd_can_network_connect_db"
        setsebool -P httpd_execmem 1 2>/dev/null || log_warning "Could not set httpd_execmem"
        setsebool -P httpd_unified 1 2>/dev/null || log_warning "Could not set httpd_unified"
        
        # SSH service policies
        setsebool -P ssh_sysadm_login 1 2>/dev/null || log_warning "Could not set ssh_sysadm_login"
        
        # Configure common file contexts
        if command -v semanage &> /dev/null; then
            semanage fcontext -a -t httpd_exec_t "/var/www/html(/.)?" 2>/dev/null || log_warning "Could not set web directory context"
            semanage fcontext -a -t httpd_log_t "/var/log/nginx(/.)?" 2>/dev/null || log_warning "Could not set nginx log context"
            
            # Restore contexts if directories exist
            [[ -d /var/www/html ]] && restorecon -R /var/www/html 2>/dev/null || true
            [[ -d /var/log/nginx ]] && restorecon -R /var/log/nginx 2>/dev/null || true
        fi
        
        log_success "Basic SELinux policies configured"
    else
        log_warning "SELinux not yet active, policies will be applied after reboot"
    fi
}

# Verify installation
verify_installation() {
    log_info "[7/$TOTAL_STEPS] Verifying SELinux installation..."
    
    # Check if SELinux packages are installed
    if command -v sestatus &> /dev/null; then
        log_success "SELinux tools installed successfully"
    else
        log_error "SELinux tools not found"
        return 1
    fi
    
    # Check audit daemon
    if systemctl is-enabled auditd &> /dev/null; then
        log_success "Audit daemon is enabled"
    else
        log_warning "Audit daemon is not enabled"
    fi
    
    # Check configuration file
    if [[ -f /etc/selinux/config ]]; then
        log_success "SELinux configuration file exists"
        log_info "Current configuration:"
        grep -E "^SELINUX=" /etc/selinux/config || true
        grep -E "^SELINUXTYPE=" /etc/selinux/config || true
    else
        log_error "SELinux configuration file not found"
        return 1
    fi
    
    # Try to check current status
    if sestatus &> /dev/null; then
        log_info "Current SELinux status:"
        sestatus | head -3
    else
        log_warning "SELinux not yet initialized (reboot required)"
    fi
}

# Final instructions
show_final_instructions() {
    log_info "[8/$TOTAL_STEPS] Installation completed!"
    
    log_warning "IMPORTANT: A system reboot is required to fully activate SELinux"
    echo ""
    echo "After reboot, you can:"
    echo "  • Check SELinux status: sestatus"
    echo "  • Check enforcement mode: getenforce"
    echo "  • Switch to permissive mode: setenforce 0"
    echo "  • Switch to enforcing mode: setenforce 1"
    echo "  • View audit logs: ausearch -m AVC"
    echo ""
    if [[ "$SELINUX_MODE" == "permissive" ]]; then
        log_info "SELinux will start in PERMISSIVE mode (logging only)"
        echo "Monitor /var/log/audit/audit.log for denials before switching to enforcing mode"
    else
        log_info "SELinux will start in ENFORCING mode (blocking violations)"
        echo "If applications fail, check audit logs and adjust policies accordingly"
    fi
    
    log_success "SELinux installation and configuration complete!"
}

# Main execution
main() {
    log_info "Starting SELinux installation and configuration..."
    
    check_privileges
    detect_distro
    
    log_info "Detected distribution: $ID"
    log_info "Package manager: $PKG_MGR"
    log_info "SELinux mode: $SELINUX_MODE"
    echo ""
    
    update_system
    install_selinux
    activate_selinux
    configure_selinux
    configure_audit
    configure_policies
    verify_installation
    show_final_instructions
}

# Run main function
main "$@"