SELinux
系統配置文件: /boot/grub/grub.conf 使用selinux=0禁用SELinux
# grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that # all kernel and initrd paths are relative to /boot/, eg. # root (hd0,0) # kernel /vmlinuz-version ro root=/dev/sda5 # initrd /initrd-[generic-]version.img #boot=/dev/sda default=0 timeout=5 splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu title CentOS 6 (2.6.32-696.el6.x86_64) root (hd0,0) kernel /vmlinuz-2.6.32-696.el6.x86_64 ro root=UUID=27c83a74-cdac-4ba8-8deb-9c74394b9896 rd_NO_LUKS rd_NO_LVM.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet selinux-0 initrd /initramfs-2.6.32-696.el6.x86_64.img
selinux配置文件
/etc/sysconfig/selinux 連接到- - - > /etc/selinux/config SELINUX={disabled|enforcing|permissive}
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=enforcing #下次系統啓動狀態 # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # mls - Multi Level Security protection. SELINUXTYPE=targeted
selinux的三種模式
enforcing:強制模式,每個受限的進程都必然受限
permissive: 警告模式,啓用,每一受限的的進程違規操作不會被禁止,但會被記錄在審計日誌中.
disabled:關閉模式
getenforce: 獲取selinux當前狀態(簡潔)
[root@centos7 ~]# getenforce #獲取selinux當前狀態 Enforcing [root@centos7 ~]# setenforce 0 #臨時有效:警告模式 [root@centos7 ~]# getenforce Permissive [root@centos7 ~]# setenforce 1 #臨時有效:強制模式 [root@centos7 ~]# getenforce Enforcing
setenforce 0|1 警告|強制
0: 設置爲permissive
1: 設置爲enforcing
此設定:僅當前有效,重啓系統無效
sestatus 查看當前的模式狀態(詳細)
[root@centos7 ~]# getenforce #獲取selinux當前式狀態(簡潔的) Enforcing [root@centos7 ~]# sestatus #查看當前selinux的模式狀態(詳細) SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing #當前模式 Mode from config file: enforcing #下次啓動生效模式 Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28
重啓有效需要更改配置文件:
配置文件: /etc/selinux/config , /etc/selinux/config
SELINUX=enforcing|permissive|disabled 決定下次開機時的selinux狀態
系統啓動在stage 2階段的時，可更改內核參數，最後加上selinux=0表示disabled selinux=1表示enforcing
上下問關係.(期望值,當前值).....標籤就是元數據中的信息
cp會刷新標籤值,更改元數據
mv不會刷新標籤,不會更改元數據元數據
centos6
從新給文件打標籤(修改當前值)
[root@centos6mini app]# ls -Z -rw-r--r--. root root unconfined_u:object_r:etc_runtime_t:s0 passwd [root@centos6mini app]# chcon -t etc_t passwd #更改passwd文件標籤 [root@centos6mini app]# ls -Z -rw-r--r--. root root unconfined_u:object_r:etc_t:s0 passwd -R：遞歸打標
還原文件默認標籤(還原期望值)
semanage fcontext -l 查看所有文件的期望值
[root@centos7 app]# semanage fcontext -l 查看所有文件的期望值 [root@centos7 app]# semanage fcontext -l |grep /root/ #配個grep一起使用 /root/.ppprc regular file system_u:object_r:pppd_etc_t:s0 [root@centos7 app]# restorecon /app/passwd 還原期望值 [root@centos7 app]# restorecon -R /app/ #遞歸還原 [root@centos6mini app]# restorecon -v passwd #顯示詳細的還原過程 restorecon reset /app/passwd context unconfined_u:object_r:etc_t:s0->unconfined_u:object_r:default_t:s0 [root@centos7 app]# systemctl restart rsyslog # 重啓服務
Semanage：來自policycoreutils-python包
文件期望值設置
查看默認的安全上下文 semanage fcontext –l
增加期望值
[root@centos7 website]# semanage fcontext -a -t httpd_sys_content_t '/app/website(/.*)?' #增加期望值
修改期望值
[root@centos7 website]# semanage fcontext -m -t var_log_t '/app/website(/.*)?' #修改期望值
刪除期望值
[root@centos7 website]# semanage fcontext -d '/app/website(/.*)?' #刪除期望值
端口標籤設置
查看端口標籤 semanage port –l
[root@centos7 yum.repos.d]# semanage port -l |grep ssh #查看指定ssh服務的標籤,端口信息 ssh_port_t tcp 22
服務增加端口號
semanage port -a -t http_port_t -p tcp 9527 #服務增加端口號
服務刪除端口號
semanage port -d -t http_port_t -p tcp 9527 #服務刪除端口號
設定布爾型規則:
[root@centos6mini app]# getsebool -a #查看所有?狀態 tftp_use_nfs --> off [root@centos6mini app]# getsebool tftp_use_nfs 查看單個狀態 tftp_use_nfs --> off [root@centos6mini app]# setsebool tftp_use_nfs 1 #開啓(臨時有效) [root@centos6mini app]# getsebool tftp_use_nfs tftp_use_nfs --> on [root@centos6mini app]# setsebool tftp_use_nfs 0 #關閉(臨時有效) [root@centos6mini app]# getsebool tftp_use_nfs tftp_use_nfs --> off [root@centos6mini app]# setsebool tftp_use_nfs on #開啓(臨時有效) [root@centos6mini app]# getsebool tftp_use_nfs tftp_use_nfs --> on [root@centos6mini app]# setsebool tftp_use_nfs off #關閉(臨時有效) [root@centos6mini app]# getsebool tftp_use_nfs tftp_use_nfs --> off [root@centos6mini app]# setsebool -P tftp_use_nfs on #開啓(永久有效) [root@centos6mini app]# getsebool tftp_use_nfs tftp_use_nfs --> on [root@centos6mini app]# setsebool -P tftp_use_nfs off #關閉(永久有效) [root@centos6mini app]# getsebool tftp_use_nfs tftp_use_nfs --> off
查看日誌文件
[root@centos6mini app]# file /var/log/audit/audit.log /var/log/audit/audit.log: ASCII text, with very long lines [root@centos6mini app]# tail /var/log/audit/audit.log #查看日誌文件 type=CRED_DISP msg=audit(1522101661.721:115): user pid=4246 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_END msg=audit(1522101661.721:116): user pid=4246 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'