![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
SELinux †NSA(膠喝遵遵九篆絮)冴Linux祉ャｃ筝冴≦宍罘(祉ャOS絎茖罘) 荵冴荐絎後莇腟狗ｈВс祉Linux茹ｈ泣ゃх≦鴻ｨ絅障ｃ ョ膂≧荐絎若сSELinux Policy Editor(seedit)膈緇篏帥医翫 SELinux篁ュ篁ｈ；祉ャOS篁ヤ絎茖絖
2010綛11憜kernel若吾SELinuxAppArmor帥 SELinux激 †SELinuxс狗ｳ綽茲違激若障
罔羣с激若у篏Distribution違с ＜帥mls≪祉篋冴障с祉ャｃ筝荀障 SELinux篏≪若 †SELinux篏≪若篁ヤ3帥若潟絖障
enforcing絎SELinux狗茵倶 enforcing篁ュ≪若с篏狗茵сpermissive≪若т絎篏違 医阪auditd綽荀障сSELinux篏睡篋絎auditd莎桁鴻莎桁 # /etc/init.d/auditd start # chkconfig auditd on 絎篏睡号 †篁ヤCentOS 5.5с荅宴с SELinux鴻 †# setenforce 1 私荐潟潟篏≪若筝紊眼с羂悟紊眼翫篁ヤ＜ゃ膩障
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=permissive # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=enforcing # 紊 SELinux≦(permissive≪若) †# setenforce 0 私荐潟潟篏≪若筝紊眼с羂悟紊眼翫篁ヤ＜ゃ膩障
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=enforcing # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=permissive # 紊 SELinux絎≦鴻翫SELinux=disabled ＜ゃｃ荐絎祉ャｃ潟潟鴻茵腓冴 †# ls -Z <祉ャｃ潟潟鴻茵腓冴＜ゃ/ｃ>
# ls -Z /var/log/messages -rw------- root root system_u:object_r:var_log_t:s0 /var/log/messages ＜ゃ荐絎祉ャｃ潟潟鴻筝荀с茵腓冴 †# semanage fcontext -l
# semanage fcontext -l SELinux fcontext type Context /.* all files system_u:object_r:default_t:s0 /xen(/.*)? all files system_u:object_r:xen_image_t:s0 /mnt(/[^/]*) symbolic link system_u:object_r:mnt_t:s0 /mnt(/[^/]*)? directory system_u:o --- 激т札筝 祉ャｃ潟潟鴻荐絎菴遵 †# semanage fcontext -a -t <菴遵祉ャｃ潟潟鴻帥ゃ> '<＜ゃ/ｃ(罩ｈ頫憜)>'
# semanage fcontext -a -t httpd_sys_script_rw_t '/var/www/wiki/(attach|backup|cache|diff|wiki)(/.*)?' 罩ｅ幻腟篋翫脂≪篏茵腓冴 ＜帥潟潟с絎荐絎с緇菴違restorecon潟潟絎茵綽荀 絎茵箴潟潟 篁ヤｃ筝apache＜ゃ篏/ゃ罔篁筝
荐絎羝帥祉ャｃ潟潟鴻茯粋昭帥荐絎 †# restorecon -RF '<荐絎>'
# restorecon -RF '/var/www/wiki' 罩ｅ幻腟篋翫脂≪篏茵腓冴 絎茵箴潟潟 /var/www/wiki(ｃ)筝絖＜ゃ/ｃ祉ャｃ潟潟鴻荐絎 祉ャｃ潟潟鴻荐絎 †# semanage fcontext -d -t <ゃ祉ャｃ潟潟鴻帥ゃ> '<＜ゃ/ｃ(罩ｈ頫憜)>' 罩ｅ幻腟篋翫脂≪篏茵腓冴 紫憜荐絎semanage fcontext -lц；腓冴 booleanゃ筝荀ц；腓 †# getsebool -a
# getsebool -a NetworkManager_disable_trans --> off aisexec_disable_trans --> off allow_console_login --> off --- 激т札筝 booleanゃ # setsebool -P samba_enable_home_dirs on booleanゃ荐絎紊 †# setsebool -P <紊眼boolean> <on|off>
# setsebool -P httpd_can_network_connect on 絎茵箴潟潟 apache若腟宴уャ泣ゃ膈若帥緇篏荐怨 SELinux≪祉号違茵腓冴 †# ausearch -m AVC /var/log/audit/audit.log茯粋昭帥SELinux≫違遵冴阪 |
