Selinux Setsebool常用设置
查看setsebool的可用选项：
[root@wastone nagios]# getsebool -a
NetworkManager_disable_trans --> off
aisexec_disable_trans --> off
allow_console_login --> off
allow_cvs_read_shadow --> off
allow_daemons_dump_core --> on
allow_daemons_use_tty --> on
allow_domain_fd_use --> on
allow_execheap --> off
allow_execmem --> on
allow_execmod --> off
allow_execstack --> on
allow_ftpd_anon_write --> off
allow_ftpd_full_access --> off
allow_ftpd_use_cifs --> off
allow_ftpd_use_nfs --> off
allow_gpg_execstack --> off
allow_gssd_read_tmp --> on
allow_httpd_anon_write --> off
allow_httpd_bugzilla_script_anon_write --> off
allow_httpd_cvs_script_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_nagios_script_anon_write --> off
allow_httpd_prewikka_script_anon_write --> off
allow_httpd_squid_script_anon_write --> off
allow_httpd_sys_script_anon_write --> off
allow_java_execstack --> off
allow_kerberos --> on
allow_mount_anyfile --> off
allow_mounton_anydir --> on
allow_mplayer_execstack --> off
allow_nfsd_anon_write --> off
allow_polyinstantiation --> off
allow_postfix_local_write_mail_spool --> off
allow_ptrace --> off
allow_rsync_anon_write --> off
allow_saslauthd_read_shadow --> off
allow_smbd_anon_write --> off
allow_ssh_keysign --> off
allow_tftp_anon_write --> off
.................
.................
常用设置：
|
===ftp=== ===httpd=== //If you want a particular domain to write to the public_content_rw_t domain setsebool -P allow_httpd_anon_write=1 or setsebool -P allow_httpd_sys__anon_write=1 //httpd can be setup to allow cgi s to be executed setsebool -P httpd_enable_cgi 1 //If you want to allow access to users home directories setsebool -P httpd_enable_homedirs 1 chcon -R -t httpd_sys_content_t ~user/public_html //httpd is allowed access to the controling terminal setsebool -P httpd_tty_comm 1 //such that one httpd service can not interfere with another setsebool -P httpd_unified 0 //loadable modules run under the same context as httpd setsebool -P httpd_builtin_ing 0 //httpd s are allowed to connect out to the network setsebool -P httpd_can_network_connect 1 // You can disable suexec transition setsebool -P httpd_suexec_disable_trans 1 //You can disable SELinux protection for the httpd daemon by executing setsebool -P httpd_disable_trans 1 service httpd restart ===named=== //If you want to have named update the master zone files setsebool -P named_write_master_zones 1 //You can disable SELinux protection for the named daemon by executing setsebool -P named_disable_trans 1 service named restart ===nfs=== //If you want to setup this machine to share nfs partitions read only setsebool -P nfs_export_all_ro 1 //If you want to share files read/write setsebool -P nfs_export_all_rw 1 //If you want to use a remote NFS server for the home directories on this machine setsebool -P use_nfs_home_dirs 1 ===samba=== //If you want to share files other than home directorie chcon -t samba_share_t /directory //If you want to share files with multiple domains setsebool -P allow_smbd_anon_write=1 //If you are setting up this machine as a Samba server and wish to share the home directories setsebool -P samba_enable_home_dirs 1 //If you want to use a remote Samba server for the home directories on this machine setsebool -P use_samba_home_dirs 1 //You can disable SELinux protection for the samba daemon by executing setsebool -P smbd_disable_trans 1 service smb restart ===rsync=== //If you want to share files using the rsync daemon chcon -t public_content_t /directories //If you want to share files with multiple domains setsebool -P allow_rsync_anon_write=1 //You can disable SELinux protection for the rsync daemon by executing setsebool -P rsync_disable_trans 1 ===kerberos=== //allow your system to work properly in a Kerberos environment setsebool -P allow_kerberos 1 //If you are running Kerberos daemons kadmind or krb5kdc setsebool -P krb5kdc_disable_trans 1 service krb5kdc restart setsebool -P kadmind_disable_trans 1 service kadmind restart ===nis=== Allow your system to work properly in a NIS environment setsebool -P allow_ypbind 1 |