Status
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: permissive
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
Permissive
Modus ändern
Bei Regelverstoß warnen, aber nicht einschränken
- setenforce 0
- setenforce permissive
Anwendungen einschränken
- setenforce 1
- setenforce enforcing
In der Konfigurationsdatei
#SELINUX=enforcing #SELinux security policy is enforced.
SELINUX=permissive #SELinux prints warnings instead of enforcing.
#SELINUX=disabled #No SELinux policy is loaded.
SELINUXTYPE=targeted #Targeted processes are protected,
#SELINUXTYPE=minimum #Modification of targeted policy. Only selected processes are protected.
#SELINUXTYPE=mls #Multi Level Security protection.
Kontext
- Dateien, Ports und Prozesse haben unter SELinux einen Kontext
- Sie sind einem SELinux-Benutzer, einer SELinux-Rolle und einem Typen zugeordnet
- mit -Z wird konventionell der Kontext angezeigt
Dateien
-rw-r--r--. 1 root root system_u:object_r:etc_t:s0 2981 11. Nov 10:22 adduser.conf
-rw-r--r--. 1 root root system_u:object_r:adjtime_t:s0 44 11. Nov 10:29 adjtime
drwxr-xr-x. 2 root root system_u:object_r:etc_t:s0 4096 6. Jan 11:14 alternatives
-rw-r--r--. 1 root root system_u:object_r:etc_t:s0 4185 29. Jul 2019 analog.cfg
drwxr-xr-x. 8 root root system_u:object_r:httpd_config_t:s0 4096 11. Nov 10:28 apache2
drwxr-xr-x. 3 root root system_u:object_r:etc_t:s0 4096 21. Nov 09:54 apparmor.d
drwxr-xr-x. 8 root root system_u:object_r:etc_t:s0 4096 11. Nov 10:29 apt
drwxr-x---. 4 root root system_u:object_r:auditd_etc_t:s0 4096 21. Nov 10:15 audit
-rw-r--r--. 1 root root system_u:object_r:etc_t:s0 1994 27. Mär 2022 bash.bashrc
- semanage fcontext -l | head
SELinux-fcontext Typ Inhalt
/ directory system_u:object_r:root_t:s0
/.* all files system_u:object_r:default_t:s0
/\.ismount-test-file regular file system_u:object_r:sosreport_tmp_t:s0
/\.journal all files <<None>>
/a?quota\.(user|group) regular file system_u:object_r:quota_db_t:s0
/afs directory system_u:object_r:mnt_t:s0
/bacula(/.*)? all files system_u:object_r:bacula_store_t:s0
/boot directory system_u:object_r:boot_t:s0
Ports
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=442,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=3))
LISTEN 0 511 *:80 *:* users:(("apache2",pid=45973,proc_ctx=system_u:system_r:httpd_t:s0,fd=4),("apache2",pid=45972,proc_ctx=system_u:system_r:httpd_t:s0,fd=4),("apache2",pid=443,proc_ctx=system_u:system_r:httpd_t:s0,fd=4))
LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=442,proc_ctx=system_u:system_r:sshd_t:s0-s0:c0.c1023,fd=4))
SELinux Port-Typ Proto Port-Nummer
afs3_callback_port_t tcp 7001
afs3_callback_port_t udp 7001
afs_bos_port_t udp 7007
afs_fs_port_t tcp 2040
afs_fs_port_t udp 7000, 7005
afs_ka_port_t udp 7004
afs_pt_port_t udp 7002
afs_vl_port_t udp 7003
Prozesse
LABEL PID TTY TIME CMD
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 46270 pts/0 00:00:00 sudo
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 46271 pts/0 00:00:00 su
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 46272 pts/0 00:00:00 bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 46864 pts/0 00:00:00 ps