SELinux

tags: IBM Linux Tools

Troubleshooting

yum install setroubleshoot
# 檢視錯誤訊息
journalctl -t setroubleshoot --since=today
# 檢視修正建議作法
sealert -a /var/log/audit/audit.log

---

Type Enforcement

• Only focus on type of security context user:role:type:level.
• unconfined_t use Linux DAC (Discretionary Access Control).

# 安裝semanage
yum install policycoreutils-python

# 列出所有受type管制的port
semanage port -l

# 列出所有受type管制的file
semanage fcontext -l

# 印出檔案type
ls -Z

# 印出程序type
ps -efZ

• 修改 policy

# 為某port新增type
semanage port -a -t <PORT_TYPE> -p tcp <PORT_NUMBER>

# 為某檔案新增type
semanage fcontext -a -t <FILE_TYPE> '<FILE_PATH>'
restorecon -Rv <FILE or DIR>

# 為某檔案刪除type
semanage fcontext -d -t <FILE_TYPE> '<FILE_PATH>'
restorecon -Rv <FILE or DIR>

• restorecon - 會依照 semanage fcontext -l 所列出的 type ，去重設所有目標資料夾與檔案的標籤。
  -R：將路徑裡所有的檔案、資料夾都一起修改。

---

Policy

• selinux-policy-<version>.rpm is a policy database
• SELINUXTYPE=targeted is a macro of policies

cat /etc/selinux/config

• 檢查白話文的 policy

sestatus -b

• 修改 policy

# 寫入硬碟，重新開機才會修正
setsebool -P httpd_can_network_connect on
# on-demand修正，重新開機不會修正
setsebool httpd_can_network_connect on

---

Mode

• Enforcing
  This is the default. In enforcing mode, if something happens on the system that is against the defined policy, the action will be both blocked and logged.

• Permissive
  This mode will not actually block or deny anything from happening, however it will log anything that would have normally been blocked in enforcing mode.

• Disabled
  Disabled is completely turned off, nothing is logged at all.

# 開機決定模式依據設定檔
$ vi /etc/selinux/config
SELINUX=enforcing
$ reboot
$ getenforce
Enforcing

# On Demand 設定模式
$ setenforce 0
$ getenforce
Permissive
$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31

---

Reference

• SELinux 教學與設定