<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<!-- file: templates/articles/assembly.xml -->

<?xml-model href="https://cdn.docbook.org/schema/5.2/rng/assemblyxi.rnc"

type="application/relax-ng-compact-syntax"?>

<!DOCTYPE assembly

[

<!ENTITY % entities SYSTEM "../common/generic-entities.ent">

%entities;

]>

<!-- refers to legacy doc: <add github link to legacy doc piece, if applicable> -->

<!-- point back to this document with a similar comment added to your legacy doc piece -->

<!-- refer to README.md for file and id naming conventions -->

<assembly version="5.2" xml:lang="en"

xmlns:xlink="http://www.w3.org/1999/xlink"

xmlns:trans="http://docbook.org/ns/transclusion"

xmlns:its="http://www.w3.org/2005/11/its"

xmlns="http://docbook.org/ns/docbook">

<!-- resources section references all topic chunks used in the final article

-->

<!-- R E S O U R C E S -->

<!-- Glue files -->

<resources>

<resource xml:id="_selinux_about" href="../concepts/selinux_about.xml">

<description>About &selnx;</description>

</resource>

<resource xml:id="_selinux-booleans" href="../concepts/selinux-booleans.xml">

<description>&selnx; booleans</description>

</resource>

<resource xml:id="_selinux-context" href="../concepts/selinux-context.xml">

<description>&selnx; context</description>

</resource>

<resource xml:id="_selinux-modes" href="../concepts/selinux-modes.xml">

<description>&selnx; modes</description>

</resource>

<resource xml:id="_selinux-policy" href="../concepts/selinux-policy.xml">

<description>&selnx; policy</description>

</resource>

<resource xml:id="_keylime" href="../concepts/keylime.xml"/>

<resource xml:id="_keylime-payload" href="../concepts/keylime-payload.xml"/>

<resource xml:id="_pam-about" href="../concepts/pam-about.xml">

<description>About PAM</description>

</resource>

</resources>

<!-- Tasks -->

<resources>

<resource xml:id="_selinux-getting-selinux" href="../tasks/selinux-getting-selinux.xml">

<description>Getting &selnx;</description>

</resource>

<resource xml:id="_selinux-policy-containers" href="../tasks/selinux-policy-containers.xml">

<description>Containers policy</description>

</resource>

<resource xml:id="_selinux-switching-modes" href="../tasks/selinux-switching-modes.xml">

<description>Switching &selnx; modes</description>

</resource>

<resource xml:id="_selinux-verification" href="../tasks/selinux-verification.xml">

<description>Checks before switching to the enforcing mode</description>

</resource>

<resource xml:id="_selinux-working-booleans" href="../tasks/selinux-working-booleans.xml">

<description>Switching &selnx; booleans</description>

</resource>

<resource xml:id="_selinux-working-with-modules" href="../tasks/selinux-working-with-modules.xml">

<description>Switching &selnx; policy modules</description>

</resource>

<resource xml:id="_selinux-troubleshooting" href="../tasks/selinux-troubleshooting.xml">

<description>Troubleshooting &selnx;</description>

</resource>

<resource xml:id="_pam-associating-with-account" href="../tasks/pam-associating-with-account.xml">

<description>Associating PAM with accounts</description>

</resource>

<resource xml:id="_pam-config-tool" href="../tasks/pam-config-tool.xml">

<description>pam-config</description>

</resource>

<resource xml:id="_pam-configuring-to-use-u2f" href="../tasks/pam-configuring-to-use-u2f.xml">

<description>Using U2F keys</description>

</resource>

<resource xml:id="_pam-manual-configuration" href="../tasks/pam-manual-configuration.xml">

<description>PAM manual configuration</description>

</resource>

<resource xml:id="_pam-sshd-configuration" href="../tasks/pam-sshd-configuration.xml">

<description>sshd configuration</description>

</resource>

<resource xml:id="_pam-update-configs" href="../tasks/pam-update-configs.xml">

<description>Updating PAM configuration</description>

</resource>

<resource xml:id="_keylime-install-agent" href="../tasks/keylime-install-agent.xml"/>

<resource xml:id="_keylime-register-agent" href="../tasks/keylime-register-agent.xml"/>

<resource xml:id="_keylime-enable-ima-tracking" href="../tasks/keylime-enable-ima-tracking.xml"/>

<resource xml:id="_keylime-run-with-podman" href="../tasks/keylime-run-with-podman.xml"/>

</resources>

<!-- References -->

<resources>

<resource xml:id="_selinux-tools" href="../references/selinux-tools.xml">

<description>&selnx; tools</description>

</resource>

<resource xml:id="_pam-configuration" href="../references/pam-configuration.xml">

<description>PAM Configuration files</description>

</resource>

<resource xml:id="_pam-configuring-modules" href="../references/pam-configuring-modules.xml">

<description>Modules configuration</description>

</resource>

</resources>

<resources>

<resource xml:id="_glue-keylime-more-info" href="../glues/keylime-more-info.xml"/>

</resources>

<resources>

<resource href="../common/legal.xml" xml:id="_legal">

<description>Legal Notice</description>

</resource>

<resource href="../common/license_gfdl1.2.xml" xml:id="_gfdl">

<description>GNU Free Documentation License</description>

</resource>

</resources>

<!-- S T R U C T U R E -->

<structure xml:id="micro-security" xml:lang="en">

<merge>

<title>&productname; Security Guide</title>

<!-- Create changelog to enable versioning; add most recent entries at the top. -->

<revhistory xml:id="rh-micro-security">

<revision><date>2023-10-26</date>

<revdescription>

<para>

Initial version

</para>

</revdescription>

</revision>

</revhistory>

<!-- TODO: provide a listing of possible and validatable meta entry values. Maybe in our geekodoc repo? -->

<!-- add author's e-mail -->

<meta name="maintainer" content="[email protected]" its:translate="no"/>

<!-- ISO date of last update as YYYY-MM-DD -->

<meta name="updated" content="2023-10-26" its:translate="no"/>

<!-- this does not work yet. Use the dm tags listed below for now

<meta name="bugtracker" its:translate="no">

<phrase role="url">https://bugzilla.suse.com/enter_bug.cgi</phrase>

<phrase role="component">Non-product-specific documentation</phrase>

<phrase role="product">Smart Docs</phrase>

<phrase role="assignee">[email protected]</phrase>

</meta>

-->

<!-- not supported, yet. Use dm: tag for now

<meta name="translation" its:translate="no">

<phrase role="trans">yes</phrase>

<phrase role="language">de-de,cs-cz</phrase>

</meta>

-->

<!-- enter the platform identifier or a list of

identifiers, separated by ; -->

<meta name="architecture" its:translate="no">

<phrase>&x86-64;</phrase>

<phrase>&power;</phrase>

</meta>

<meta name="productname" its:translate="no">

<productname version="5.5">&slem;</productname>

</meta>

<meta name="title" its:translate="yes">The SLE Micro security guide</meta>

<meta name="description" its:translate="yes">The article provides details regarding SELinux, PAM and keylime.</meta>

<meta name="social-descr" its:translate="yes">SELinux, PAM, keylime.</meta>

<meta name="task" its:translate="no">

<phrase>Security</phrase>

<phrase>Administration</phrase>

<phrase>Implementation</phrase>

</meta>

<meta name="series" its:translate="no">Products &amp; Solutions</meta>

<dm:docmanager xmlns:dm="urn:x-suse:ns:docmanager">

<dm:bugtracker>

<dm:url>https://bugzilla.suse.com/enter_bug.cgi</dm:url>

<dm:component>Documentation</dm:component>

<dm:product>SUSE Linux Enterprise Micro 5.5</dm:product>

<dm:assignee>[email protected]</dm:assignee>

</dm:bugtracker>

<dm:translation>yes</dm:translation>

</dm:docmanager>

<abstract>

<variablelist>

<varlistentry>

<term>WHAT?</term>

<listitem>

<para>

This book describes the basics of &selnx; and remote attestation using Keylime, and focuses on securing local access to a machine using PAM.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>WHY?</term>

<listitem>

<para>

You would like to be introduced to security solutions available on &productname;.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>EFFORT</term>

<listitem>

<para>

The &selnx; topic takes approx. 40 minutes to read. The PAM configuration takes approx. 20 minutes to read. The Keylime attestation takes approx. 15 minutes.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>GOAL</term>

<listitem>

<para>

A better understanding of &selnx;, PAM and Keylime.

</para>

</listitem>

</varlistentry>

</variablelist>

</abstract>

</merge>

<!-- pull in all the topic files you need -->

<!-- pick the appropriate type of include to match your needs -->

<!-- pull in a topic as is -->

<module renderas="chapter">

<merge>

<title>&selnx;</title>

</merge>

<module resourceref="_selinux_about" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_selinux-getting-selinux" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_selinux-modes" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

<module resourceref="_selinux-switching-modes" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_selinux-verification" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

<module resourceref="_selinux-context" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_selinux-policy" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

<module resourceref="_selinux-working-with-modules" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_selinux-policy-containers" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

<module resourceref="_selinux-booleans" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

<module resourceref="_selinux-working-booleans" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

<module resourceref="_selinux-tools" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_selinux-troubleshooting" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

<module renderas="chapter">

<merge>

<title>PAM on &productnameshort;</title>

</merge>

<module resourceref="_pam-about" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_pam-configuration" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

<module resourceref="_pam-sshd-configuration" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

<module resourceref="_pam-configuring-modules" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_pam-config-tool" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_pam-manual-configuration" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_pam-configuring-to-use-u2f" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

<module resourceref="_pam-associating-with-account" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module resourceref="_pam-update-configs" renderas="section">

<merge>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

</module>

<module renderas="chapter">

<merge>

<title>Attestation using Keylime</title>

</merge>

<module resourceref="_keylime" renderas="section">

<module renderas="section" resourceref="_keylime-run-with-podman">

<merge>

<title>Setting up the verifier, registrar and tenant</title>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module renderas="section" resourceref="_keylime-install-agent">

<merge>

<title>Installing the agent</title>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module renderas="section" resourceref="_keylime-register-agent">

<merge>

<title>Registering the agent</title>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module renderas="section" resourceref="_keylime-payload">

<merge>

<title>Secure payloads</title>

<abstract>

<para/>

</abstract>

</merge>

</module>

<module renderas="section" resourceref="_keylime-enable-ima-tracking">

<merge>

<title>Enabling IMA tracking</title>

<abstract>

<para/>

</abstract>

</merge>

</module>

</module>

<module renderas="section" resourceref="_glue-keylime-more-info"/>

</module>

<module resourceref="_legal" renderas="appendix"/>

<module resourceref="_gfdl">

<output renderas="appendix"/>

</module>

</structure>

</assembly>