SELinux Handling
Version vom 9. Januar 2023, 10:45 Uhr von Linkai.zhang (Diskussion | Beiträge)
Status
- sestatus
SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28
- getenforce
Permissive
Modus ändern
Bei Regelverstoß warnen, aber nicht einschränken
- setenforce 0
- setenforce permissive
Anwendungen einschränken
- setenforce 1
- setenforce enforcing
In der Konfigurationsdatei
- cat /etc/selinux/config
#SELINUX=enforcing #SELinux security policy is enforced. SELINUX=permissive #SELinux prints warnings instead of enforcing. #SELINUX=disabled #No SELinux policy is loaded. SELINUXTYPE=targeted #Targeted processes are protected, #SELINUXTYPE=minimum #Modification of targeted policy. Only selected processes are protected. #SELINUXTYPE=mls #Multi Level Security protection.
Kontext
- Dateien, Ports und Prozesse haben unter SELinux einen Kontext
- Sie sind einem SELinux-Benutzer, einer SELinux-Rolle und einem Typen zugeordnet
- mit -Z wird konventionell der Kontext angezeigt
Dateien
- ls -lZ /etc | head
-rw-r--r--. 1 root root system_u:object_r:etc_t:s0 2981 11. Nov 10:22 adduser.conf -rw-r--r--. 1 root root system_u:object_r:adjtime_t:s0 44 11. Nov 10:29 adjtime drwxr-xr-x. 2 root root system_u:object_r:etc_t:s0 4096 6. Jan 11:14 alternatives -rw-r--r--. 1 root root system_u:object_r:etc_t:s0 4185 29. Jul 2019 analog.cfg drwxr-xr-x. 8 root root system_u:object_r:httpd_config_t:s0 4096 11. Nov 10:28 apache2 drwxr-xr-x. 3 root root system_u:object_r:etc_t:s0 4096 21. Nov 09:54 apparmor.d drwxr-xr-x. 8 root root system_u:object_r:etc_t:s0 4096 11. Nov 10:29 apt drwxr-x---. 4 root root system_u:object_r:auditd_etc_t:s0 4096 21. Nov 10:15 audit -rw-r--r--. 1 root root system_u:object_r:etc_t:s0 1994 27. Mär 2022 bash.bashrc
- semanage fcontext -l | head
SELinux-fcontext Typ Inhalt / directory system_u:object_r:root_t:s0 /.* all files system_u:object_r:default_t:s0 /\.ismount-test-file regular file system_u:object_r:sosreport_tmp_t:s0 /\.journal all files <<None>> /a?quota\.(user|group) regular file system_u:object_r:quota_db_t:s0 /afs directory system_u:object_r:mnt_t:s0 /bacula(/.*)? all files system_u:object_r:bacula_store_t:s0 /boot directory system_u:object_r:boot_t:s0
Ports
- ss -lntpZ
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=442,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=3))
LISTEN 0 511 *:80 *:* users:(("apache2",pid=45973,proc_ctx=system_u:system_r:httpd_t:s0,fd=4),("apache2",pid=45972,proc_ctx=system_u:system_r:httpd_t:s0,fd=4),("apache2",pid=443,proc_ctx=system_u:system_r:httpd_t:s0,fd=4))
LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=442,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=4))
- semanage port -l
SELinux Port-Typ Proto Port-Nummer afs3_callback_port_t tcp 7001 afs3_callback_port_t udp 7001 afs_bos_port_t udp 7007 afs_fs_port_t tcp 2040 afs_fs_port_t udp 7000, 7005 afs_ka_port_t udp 7004 afs_pt_port_t udp 7002 afs_vl_port_t udp 7003