SELinux 基本用法

1. coreutils 的工具如 ps、ls 可以增加 Z 選項的方式取得 SELinux 的資訊。

   [root@kvm7 ~]# ls -Z anaconda-ks.cfg 
   -rw-------. root root system_u:object_r:admin_home_t:s0 anaconda-ks.cfg
   [root@kvm7 ~]# ps auxZ | grep apache
   system_u:system_r:httpd_t:s0  apache  15694  0.0  0.2 215320  3040 ?  S
       Oct14   0:00 /usr/sbin/httpd -DFOREGROUND
   

2. chcon 修改檔案或目錄的 SELinux contexts。

   [root@kvm7 ~]# chcon --help
   Usage: chcon [OPTION]... CONTEXT FILE...
     or:  chcon [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE...
     -u, --user=USER        set user USER in the target security context
     -r, --role=ROLE        set role ROLE in the target security context
     -t, --type=TYPE        set type TYPE in the target security context
     -l, --range=RANGE      set range RANGE in the target security context
     -R, --recursive        operate on files and directories recursively
     -v, --verbose          output a diagnostic for every file processed
   

3. chcon 範例

   [root@kvm7 ~]# ls -Z /etc/resolv.conf 
   -rw-r--r--. root root system_u:object_r:net_conf_t:s0  /etc/resolv.conf
   [root@kvm7 ~]# cp /etc/resolv.conf .
   [root@kvm7 ~]# ls -Z resolv.conf 
   -rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 resolv.conf
   [root@kvm7 ~]# chcon -t net_conf_t resolv.conf 
   [root@kvm7 ~]# ls -Z resolv.conf 
   -rw-r--r--. root root unconfined_u:object_r:net_conf_t:s0 resolv.conf
   

4. restorecon 恢復檔案或目錄的 SELinux contexts 到預設值。

   [root@kvm7 ~]# restorecon
   usage:  restorecon [-iFnprRv0] [-e excludedir] pathname...
   usage:  restorecon [-iFnprRv0] [-e excludedir] -f filename
   

5. restorecon 範例

   [root@kvm7 ~]# restorecon resolv.conf 
   [root@kvm7 ~]# ls -Z resolv.conf 
   -rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 resolv.conf
   

6. getsebool 查詢 SELinux 布林值型規則的狀態。

   [root@kvm7 ~]# getsebool 
   usage:  getsebool -a or getsebool boolean...
   

7. getsebool 範例

   [root@kvm7 ~]# getsebool -a | grep ssh
   fenced_can_ssh --> off
   selinuxuser_use_ssh_chroot --> off
   sftpd_write_ssh_home --> off
   ssh_chroot_rw_homedirs --> off
   ssh_keysign --> off
   ssh_sysadm_login --> off
   

8. setsebool 開關 SELinux 布林值型規則。

   [root@kvm7 ~]# setsebool 
   Usage:  setsebool [ -NPV ] boolean value | bool1=val1 bool2=val2...
   

9. setsebool 範例，沒加 -P 選項只是現在生效，重開機後會恢復到原設定值。

   [root@kvm7 ~]# setsebool sftpd_write_ssh_home on
   [root@kvm7 ~]# getsebool -a | grep ssh
   fenced_can_ssh --> off
   selinuxuser_use_ssh_chroot --> off
   sftpd_write_ssh_home --> on
   ssh_chroot_rw_homedirs --> off
   ssh_keysign --> off
   ssh_sysadm_login --> off
   

10. semanage 設定 SELinux 策略的某些元素，例如：檔案 context、程序埠號等。

    [root@kvm7 ~]# semanage 
    usage: semanage [-h]
                    
                    {...,port,..,fcontext,...}
                    ...
    semanage is used to configure certain elements of SELinux policy with-out
    requiring modification to or recompilation from policy source.
    
        port              Manage network port type definitions
        fcontext          Manage file context mapping definitions
        boolean           Manage booleans to selectively enable functionality
    

11. semanage 範例一：添加目錄的 SELinux context。

    [root@kvm7 ~]# mkdir /usr/share/www
    [root@kvm7 ~]# ls -Z /usr/share/www
    [root@kvm7 ~]# ls -Zd /usr/share/www
    drwxr-xr-x. root root unconfined_u:object_r:usr_t:s0   /usr/share/www
    [root@kvm7 ~]# semanage fcontext -a -t httpd_sys_content_t "/usr/share/www(/.*)?"
    [root@kvm7 ~]# ls -Zd /usr/share/www
    drwxr-xr-x. root root unconfined_u:object_r:usr_t:s0   /usr/share/www
    [root@kvm7 ~]# restorecon -Rv /usr/share/www
    restorecon reset /usr/share/www context unconfined_u:object_r:usr_t:s0
    ->unconfined_u:object_r:httpd_sys_content_t:s0
    [root@kvm7 ~]# ls -Zd /usr/share/www
    drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 /usr/share/www
    

12. semanage 範例二：添加 httpd 程序允許訪問的 port。

    [root@kvm7 ~]# semanage port -l | grep ^http_port
    http_port_t      tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
    [root@kvm7 ~]# semanage port -a -t http_port_t -p tcp 8989
    [root@kvm7 ~]# semanage port -l | grep ^http_port
    http_port_t      tcp      8989, 80, 81, 443, 488, 8008, 8009, 8443, 9000
    

13. semanage 範例三：刪除 httpd 程序允許訪問的 port。

    [root@kvm7 html]# semanage port -d -t http_port_t -p tcp 8989
    [root@kvm7 html]# semanage port -l | grep ^http_port
    http_port_t       tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000