SELinux

系统配置文件: /boot/grub/grub.conf   使用selinux=0禁用SELinux

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/sda5
#          initrd /initrd-[generic-]version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS 6 (2.6.32-696.el6.x86_64)
        root (hd0,0)
        kernel /vmlinuz-2.6.32-696.el6.x86_64 ro root=UUID=27c83a74-cdac-4ba8-8deb-9c74394b9896 rd_NO_LUKS rd_NO_LVM.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet  selinux-0
        initrd /initramfs-2.6.32-696.el6.x86_64.img

 

 

selinux配置文件                           

 /etc/sysconfig/selinux 连接到- - - >     /etc/selinux/config    SELINUX={disabled|enforcing|permissive}

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#    enforcing - SELinux security policy is enforced.
#    permissive - SELinux prints warnings instead of enforcing.
#    disabled - No SELinux policy is loaded.
SELINUX=enforcing   #下次系统启动状态
# SELINUXTYPE= can take one of these two values:
#    targeted - Targeted processes are protected,
#    mls - Multi Level Security protection.
SELINUXTYPE=targeted

 

selinux的三种模式

    enforcing:强制模式,每个受限的进程都必然受限

    permissive: 警告模式,启用,每一受限的的进程违规操作不会被禁止,但会被记录在审计日志中.

    disabled:关闭模式

getenforce: 获取selinux当前状态(简洁)

[root@centos7 ~]# getenforce   #获取selinux当前状态
Enforcing
[root@centos7 ~]# setenforce 0  #临时有效:警告模式
[root@centos7 ~]# getenforce 
Permissive
[root@centos7 ~]# setenforce 1  #临时有效:强制模式
[root@centos7 ~]# getenforce 
Enforcing

 

setenforce 0|1  警告|强制

        0: 设置为permissive 

        1: 设置为enforcing

此设定:仅当前有效,重启系统无效

 

sestatus 查看当前的模式状态(详细)

[root@centos7 ~]# getenforce   #获取selinux当前式状态(简洁的)
Enforcing
[root@centos7 ~]# sestatus  #查看当前selinux的模式状态(详细)
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing   #当前模式
Mode from config file:          enforcing   #下次启动生效模式
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

 

重启有效需要更改配置文件:

配置文件: /etc/selinux/config , /etc/selinux/config

  SELINUX=enforcing|permissive|disabled 决定下次开机时的selinux状态

系统启动在stage 2阶段的时，可更改内核参数，最后加上selinux=0表示disabled selinux=1表示enforcing

 

上下问关系.(期望值,当前值).....标签就是元数据中的信息

cp会刷新标签值,更改元数据

mv不会刷新标签,不会更改元数据元数据

centos6

从新给文件打标签(修改当前值)

-R：递归打标

[root@centos6mini app]# ls -Z
-rw-r--r--. root root unconfined_u:object_r:etc_runtime_t:s0 passwd
[root@centos6mini app]# chcon -t etc_t passwd   #更改passwd文件标签
[root@centos6mini app]# ls -Z
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   passwd

 

还原文件默认标签(还原期望值)

semanage fcontext -l  查看所有文件的期望值

[root@centos7 app]# semanage fcontext -l  查看所有文件的期望值
[root@centos7 app]# semanage fcontext -l |grep /root/  #配个grep一起使用
/root/.ppprc                regular file      system_u:object_r:pppd_etc_t:s0 
[root@centos7 app]# restorecon /app/passwd  还原期望值
[root@centos7 app]# restorecon -R  /app/   #递归还原
[root@centos6mini app]# restorecon -v  passwd   #显示详细的还原过程
restorecon reset /app/passwd context unconfined_u:object_r:etc_t:s0->unconfined_u:object_r:default_t:s0
[root@centos7 app]# systemctl restart rsyslog  # 重启服务

 

Semanage：来自policycoreutils-python包 

 

文件期望值设置

查看默认的安全上下文 semanage fcontext –l
增加期望值

[root@centos7 website]# semanage fcontext -a -t httpd_sys_content_t '/app/website(/.*)?' #增加期望值

 

修改期望值

[root@centos7 website]# semanage fcontext -m -t var_log_t '/app/website(/.*)?' #修改期望值

 

删除期望值

[root@centos7 website]# semanage fcontext -d '/app/website(/.*)?' #删除期望值

 

 

端口标签设置

查看端口标签  semanage port –l

[root@centos7 yum.repos.d]# semanage port -l |grep ssh  #查看指定ssh服务的标签,端口信息
ssh_port_t                    tcp      22

 

服务增加端口号

semanage port -a -t http_port_t  -p tcp 9527  #服务增加端口号

 

服务删除端口号

semanage port -d -t http_port_t -p tcp 9527  #服务删除端口号

 

 

设定布尔型规则:

[root@centos6mini app]# getsebool -a   #查看所有?状态
tftp_use_nfs --> off
[root@centos6mini app]# getsebool tftp_use_nfs 查看单个状态
tftp_use_nfs --> off
[root@centos6mini app]# setsebool tftp_use_nfs 1     #开启(临时有效)
[root@centos6mini app]# getsebool tftp_use_nfs    
tftp_use_nfs --> on
[root@centos6mini app]# setsebool tftp_use_nfs 0     #关闭(临时有效)
[root@centos6mini app]# getsebool tftp_use_nfs
tftp_use_nfs --> off
[root@centos6mini app]# setsebool tftp_use_nfs on    #开启(临时有效)
[root@centos6mini app]# getsebool tftp_use_nfs
tftp_use_nfs --> on
[root@centos6mini app]# setsebool tftp_use_nfs off   #关闭(临时有效)
[root@centos6mini app]# getsebool tftp_use_nfs
tftp_use_nfs --> off
[root@centos6mini app]# setsebool -P tftp_use_nfs on    #开启(永久有效)
[root@centos6mini app]# getsebool tftp_use_nfs
tftp_use_nfs --> on
[root@centos6mini app]# setsebool -P tftp_use_nfs off   #关闭(永久有效)
[root@centos6mini app]# getsebool tftp_use_nfs
tftp_use_nfs --> off

 

 

查看日志文件

[root@centos6mini app]# file /var/log/audit/audit.log 
/var/log/audit/audit.log: ASCII text, with very long lines
[root@centos6mini app]# tail /var/log/audit/audit.log  #查看日志文件
type=CRED_DISP msg=audit(1522101661.721:115): user pid=4246 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1522101661.721:116): user pid=4246 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'