理解Linux下的SELinux( 二 ) _SELinux

SELinux Type：安全策略使用SELinux Type制定规则，定义何种Domian（Type）的Subject，可以接入何种Type的Object 。

文章插图

显示进程的Context

~]# ps -ZLABELPID TTYTIME CMDunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 9509 pts/1 00:00:00 sudounconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 9515 pts/1 00:00:00 suunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 9516 pts/1 00:00:00 bashunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 9544 pts/1 00:00:00 ps

显示文件的Context信息
~]# ls -Zsystem_u:object_r:admin_home_t:s0 anaconda-ks.cfg临时修改文件的SELinux Type 为htttpd_sys_content_t
~]# chcon -t httpd_sys_content_t file-nameSELinux 的运行状态SELinux 有三个运行状态，分别是disabled, permissive 和 enforcing

Disable：禁用SELinux，不会给任何新资源打Label，如果重新启用的话，将会给资源重新打上Lable，过程会比较缓慢。
Permissive：如果违反安全策略，并不会真正的执行拒绝操作，替代的方式是记录一条log信息。
Enforcing: 默认模式，SELinux的正常状态，会实际禁用违反策略的操作

查看当前的运行状态
~]# getenforceEnforcing临时改变运行状态为Permissive
~]# setenforce 0~]# getenforcePermissive临时改变运行状态为 Enforcing
~]# setenforce 1~]# getenforceEnforcing使用sestatus可以查看完整的状态信息

~]# sestatusSELinux status:enabledSELinuxfs mount:/sys/fs/selinuxSELinux root directory:/etc/selinuxLoaded policy name:targetedCurrent mode:enforcingMode from config file:enforcingPolicy MLS status:enabledPolicy deny_unknown status:allowedMax kernel policy version:30

SELinux LogSELinux 的Log日志默认记录在/var/log/audit/audit.log

~]# cat /var/log/audit/audit.logtype=AVC msg=audit(1223024155.684:49): avc:denied{ getattr } forpid=2000 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=399185 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:samba_share_t:s0 tclass=file

/var/log/message 也会记录相应的信息，例如：

May 7 18:55:56 localhost setroubleshoot: SELinux is preventing httpd (httpd_t) "getattr" to /var/www/html/file1 (samba_share_t). For complete SELinux messages. run sealert -l de7e30d6-5488-466d-a606-92c9f40d316d

SELinux 配置文件SELinux的配置文件位于/etc/selinux/config 。默认配置文件主要两部分，一个是SELinux的运行状态和SELinuxType 。直接在配置文件中修改SELinux将会在下次启动时生效。

# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:#enforcing - SELinux security policy is enforced.#permissive - SELinux prints warnings instead of enforcing.#disabled - No SELinux policy is loaded.SELINUX=enforcing# SELINUXTYPE= can take one of these two values:#targeted - Targeted processes are protected,#mls - Multi Level Security protection.SELINUXTYPE=targeted

SELinux BooleansBooleans允许在运行时修改SELinux安全策略。
列出所有的Booleans选项

~]# semanage boolean -lSELinux booleanStateDefault Descriptionsmartmon_3ware(off,off)Determine whether smartmon can...mpd_enable_homedirs(off,off)Determine whether mpd can traverse...

临时修改httpd_can_network_connect_db状态为开启
~]# setsebool httpd_can_network_connect_db on深入研究https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#chap-Security-Enhanced_Linux-Working_with_SELinux

http://www.kroah.com/linux/talks/ols_2002_lsm_paper/lsm.pdf

https://www.cs.cmu.edu/~dga/papers/flask-usenixsec99.pdf

https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf

【理解Linux下的SELinux】