SELinux拾遗

1. SELinux决策示意

   
   

2. 什么是AVC
   To improve the efficiency of its operation, the security server caches access vectors in a data structure called the access vector cache (AVC).

3. Process creation and domain transition

   
   

4. File creation and transition decisions

   
   

5. SELinux commands

• chcon
  Labels a specified file, or set of files, with a specified security context.

• checkpolicy
  Performs a variety of policy-related actions, including compiling policy sources to binary and loading a binary policy into a kernel. The command is typically invoked via the SELinux Makefile rather than directly.

• getenforce
  Displays a message indicating whether SELinux is currently in permissive mode or enforcing mode. Useful only for kernels compiled with support for permissive mode.

• newrole
  Enables a user to transition from one authorized role to another.

• run_ini
  Used to start, stop, or otherwise control a service. Ensures that the operation is executed in the same context used when services are automatically started, stopped, or controlled by Init.

• setenforce
  If given the argument 0, places SELinux in permissive mode; if given the argument 1, places SELinux in enforcing mode.

• setfiles
  Sets file labels for a specified directory and its subdirectories, based on the specifications provided in FC files. The command is typically invoked via the SELinux Makefile rather than directly, and is generally used only during initial SELinux configuration.
  Older versions of SELinux included the following commands, which have been retained in the current version for the convenience of users familiar with them:

• avc_enforcing
  Equivalent to getenforce.

• avc_toggle
  Switches the system from enforcing to permissive mode, or vice versa.

6. Role
   SELinux users have one or more associated roles and, at any time, are bound to exactly one of these.Users are initially bound to a role at login time.
   The standard SELinux security policy defines four roles:

• staff_r
  Used for users permitted to enter the sysadm_r role
• sysadm_r
  Used for the system administrator
• system_r
  Used for system processes and objects
• user_r
  Used for ordinary users

Please bear in mind that only users who are associated with the staff_r role can transition to the sysadm_r role by issuing the newrole command. Your SELinux user configuration determines whether a user is associated with the staff_r or user_r role. Also, if you're using Fedora Core, recall that its su command has been modified to automatically transition to the sysadm_r role when you become the root user.

7. SELinux User
   By default, only three SELinux users are defined:

• root
  Used by the system administrator
• system_u
  Used by system processes and objects
• user_u
  Used by generic users having no specific SELinux user identity