{"id":18201,"date":"2014-02-24T06:23:44","date_gmt":"2014-02-23T22:23:44","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/02\/24\/selinux-%e5%82%99%e5%bf%98\/"},"modified":"2014-02-24T06:23:44","modified_gmt":"2014-02-23T22:23:44","slug":"selinux-%e5%82%99%e5%bf%98","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/02\/24\/selinux-%e5%82%99%e5%bf%98\/","title":{"rendered":"SELinux \u5099\u5fd8"},"content":{"rendered":"

SELinux \u8a2d\u5b9a\u6a94
# cat \/etc\/selinux\/config<\/span><\/p>\n

# This file controls the state of SELinux on the system.<\/span>
# SELINUX= can take one of these three values:<\/span>
#\u00a0\u00a0\u00a0\u00a0 enforcing – SELinux security policy is enforced.<\/span>
#\u00a0\u00a0\u00a0\u00a0 permissive – SELinux prints warnings instead of enforcing.<\/span>
#\u00a0\u00a0\u00a0\u00a0 disabled – No SELinux policy is loaded.<\/span>
SELINUX=enforcing<\/span>
# SELINUXTYPE= can take one of these two values:<\/span>
#\u00a0\u00a0\u00a0\u00a0 targeted – Targeted processes are protected,<\/span>
#\u00a0\u00a0\u00a0\u00a0 mls – Multi Level Security protection.<\/span>
SELINUXTYPE=targeted<\/span><\/p>\n

\u986f\u793a\u76ee\u524d SELinux \u72c0\u614b
# sestatus<\/span>
SELinux status:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 enabled<\/span>
SELinuxfs mount:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/selinux<\/span>
Current mode:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 enforcing<\/span>
Mode from config file:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 enforcing<\/span>
Policy version:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 24<\/span>
Policy from config file:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 targeted<\/span><\/p>\n

# sestatus<\/span>
SELinux status:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 disabled<\/span>
[@more@]
\u6539\u8b8a SELinux \u6a21\u5f0f
# getenforce<\/span>
Enforcing
# setenforce 0<\/span>
# getenforce<\/span>
Permissive<\/span>
# setenforce 1<\/span>
# getenforce<\/span>
Enforcing<\/span>
# setenforce –help<\/span>
usage:\u00a0 setenforce [ Enforcing | Permissive | 1 | 0 ]<\/span><\/p>\n

Display SELinux Contexts
# ls -Z \/root\/anaconda-ks.cfg<\/span>
-rw——-. root root system_u:object_r:admin_home_t:s0 \/root\/anaconda-ks.cfg<\/span>
# ls -dZ \/var\/www\/html<\/span>
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/<\/span><\/p>\n

Set SELinux Contexts
# touch index-1.html<\/span>
# touch \/var\/www\/html\/index.html<\/span>
# mv index-1.html \/var\/www\/html\/<\/span>
# ls -Z \/var\/www\/html\/*.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:admin_home_t:s0 \/var\/www\/html\/index-1.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index.html<\/span>
# chcon -t httpd_sys_content_t \/var\/www\/html\/index-1.html<\/span>
# ls -Z \/var\/www\/html\/*.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index-1.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index.html<\/span><\/p>\n

# touch index-2.html<\/span>
# mv index-2.html \/var\/www\/html<\/span>
# ls -Z \/var\/www\/html\/*.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index-1.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:admin_home_t:s0 \/var\/www\/html\/index-2.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index.html<\/span>
# restorecon -v \/var\/www\/html\/index-2.html<\/span>
restorecon reset \/var\/www\/html\/index-2.html context unconfined_u:object_r:admin_home_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0<\/span>
# ls -Z \/var\/www\/html\/*.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index-1.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index-2.html<\/span>
-rw-r–r–. root root unconfined_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index.html<\/span><\/p>\n

Get SELinux booleans
# getsebool -a | head -10<\/span>
abrt_anon_write –> off<\/span>
abrt_handle_event –> off<\/span>
allow_console_login –> on<\/span>
allow_cvs_read_shadow –> off<\/span>
allow_daemons_dump_core –> on<\/span>
allow_daemons_use_tcp_wrapper –> off<\/span>
allow_daemons_use_tty –> on<\/span>
allow_domain_fd_use –> on<\/span>
allow_execheap –> off<\/span>
allow_execmem –> on<\/span><\/p>\n

# getsebool -a | grep ftp<\/span>
allow_ftpd_anon_write –> off<\/span>
allow_ftpd_full_access –> off<\/span>
allow_ftpd_use_cifs –> off<\/span>
allow_ftpd_use_nfs –> off<\/span>
ftp_home_dir –> off<\/span>
ftpd_connect_db –> off<\/span>
ftpd_use_fusefs –> off<\/span>
ftpd_use_passive_mode –> off<\/span>
httpd_enable_ftp_server –> off<\/span>
tftp_anon_write –> off<\/span>
tftp_use_cifs –> off<\/span>
tftp_use_nfs –> off<\/span><\/p>\n

# getsebool ftp_home_dir<\/span>
ftp_home_dir –> off<\/span><\/p>\n

Set SELinux booleans
# setsebool ftp_home_dir 1<\/span>
# getsebool ftp_home_dir<\/span>
ftp_home_dir –> on<\/span>
# setsebool ftp_home_dir 0<\/span>
# getsebool ftp_home_dir<\/span>
ftp_home_dir –> off<\/span><\/p>\n

\u8b93\u8a2d\u5b9a\u6c38\u9060\u751f\u6548
# setsebool -P ftp_home_dir 1<\/span><\/p>\n

# yum install policycoreutils-python<\/span><\/p>\n

\u53d6\u5f97\u76f8\u95dc\u8cc7\u8a0a
# semanage boolean -l | grep ftp_home_dir<\/span>
ftp_home_dir\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (\u958b\u555f\u00a0\u00a0 ,\u00a0\u00a0 \u958b\u555f)\u00a0 Allow ftp to read and write files in the user home directories<\/span><\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

SELinux \u8a2d\u5b9a\u6a94# cat \/etc\/selinux\/config # This file contro … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008SELinux \u5099\u5fd8\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[136],"tags":[],"class_list":["post-18201","post","type-post","status-publish","format-standard","hentry","category-c-78481"],"meta_key":{"_encloseme":["1"],"lt_post_id":["471511"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18201"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18201"}],"version-history":[{"count":0,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18201\/revisions"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}