SELinux

�P於 SELinux

发表于 2009-02-25 20:54 作者: wangyu1314

看了很多�W路上有�P於 SELinux 的文章以及到��店去翻了一下有提到 SELinux 的 Linux ��籍
看完了的感�X不是很好
�缀醵�]提到什�N是 SELinux？SELinux 的�\作�C制是什�N？
大部份提到的解�Q�k法，都是 “�把 SELinux 停用”
�@�右仓徊贿^是治�硕�不是治本的方法
SELinux 的�O定�n

* /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - SELinux is fully disabled.
SELINUX=enforcing
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

若要停用 SELinux，�t把 SELINUX=enforcing 改成 SELINUX=disabled 後重新�_�C即可
SELinux 的一些相�P指令

* sestatus
查看 SELinux 是否�⒂眉澳壳��B如何的指令
如:
1.SELinux Disabled

$ sestatus
SELinux status: disabled

2.SELinux Enabled
mode: enforcing
Policy: targeted

$ sestatus
SELinux status: disabled
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 18
Policy from config file:targeted

Policy booleans:
...skip...
httpd_builtin_scripting active
httpd_disable_trans active
httpd_enable_cgi active
httpd_enable_homedirs active
httpd_ssi_exec active
httpd_tty_comm inactive
httpd_unified active
...skip...

* system-config-securitylevel
�D形化介面的工具程式，除了可以�O定防火��(iptables)外，也可以�O定 SELinux

* setenforce
在 SELinux ���� enforcing 的��r下，可以�绦� “setenforce 0“ ��� SELinux ��r停用

* getsebool and setsebool
/etc/selinux/targeted/booleans �@���n�e面放的就是各�� Policy 的布林值，不�^，在 FC5 之後，已��]有�@���n了，你可以用
$ getsebool -a
�聿榭此�有的 booleans �O定��r
或是使用如:
$ setsebool -P httpd_disable_trans 1
��� httpd_disable_trans 停用，�@�悠��也就等於是停用 SELinux �� httpd 的保�o了

* chcon
�鹘y的 chmod 指令是用�碓O定�n案或目�的�嘞薜模�而同�拥� chcon 指令�t是用�碓O定 SELinux ��n案或目�的 content �嘶`的

* fixfiles
fixfiles check 指令可以用��z查�n案或目�的 SELinux content
fixfiles restore 指令�t可以用�硇拚�(�原)�n案或目�的 SELinux content
fixfiles relabel �t是��重新修正(�原)所有的�n案及目�的 SELinux content
如何在 SELinux ���� enforcing 的��r下也� Web Server(httpd) 能正常�\作？

前面提到，我��可以�� SELinux 停用(disabled) 或是�绦� “setsebool -P httpd_disable_trans 1“ �硗Ｓ� SELinux �� httpd 的保�o，�@�樱�httpd 就可以跟平常一�拥倪\作了
那如果我��要�⒂� SELinux 且� httpd 也可以正常�\作呢？
�e��例子�碚f:

[root@acer:~] pwd
/root
[root@acer:~] echo "< ? phpinfo(); ?>" > index.php
[root@acer:~] mv index.php /var/www/html/
`index.php' -> `/var/www/html/index.php'
[root@acer:~]

在上述的指令中，我在 root 的 $HOME 目�下�a生了一�� index.php 的�n案，�热�轱@示 phpinfo
然後把再把�@���n案搬移到 /var/www/html 目�底下，然後�_ browser ��g�[ http://localhost/index.php �@���面，得到的��面�s是:

Forbidden

You don't have permission to access /index.php on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

�]�e，�o法存取，我���砜匆豢吹降资窃觞N回事:

[root@acer:~] ls -Z /var/www/html/index.php
-rw-r--r-- root root root:object_r:user_home_t /var/www/html/index.php
[root@acer:~]
[root@acer:~] ls -Z /var/www/
drwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t cgi-bin/
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t error/
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t html/
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t icons/
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t manual/

因�� index.php 的 content type �� user_home_t 而不是 httpd_sys_content_t 所以�o法存取
因此，我��可以�绦�:

[root@acer:~] chcon -u system_u -t httpd_sys_content_t /var/www/html/index.php
[root@acer:~] ls -Z /var/www/html/index.php
-rw-r--r-- root root system_u:object_r:httpd_sys_content_t /var/www/html/index.php

�再�_一次 browser (or reload)，�F在是不是可以正常存取 index.php �面了呢？

再看另一��例子:

[root@acer:~] wget http://wordpress.org/latest.tar.gz
--13:36:59-- http://wordpress.org/latest.tar.gz
=> `latest.tar.gz'
Resolving wordpress.org... 72.232.44.122
Connecting to wordpress.org|72.232.44.122|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]

[ < => ] 505,475 90.49K/s

13:37:07 (90.28 KB/s) - `latest.tar.gz' saved [505475]

[root@acer:~] tar zxf latest.tar.gz
[root@acer:~] mv wordpress /var/www/html/wp
`wordpress' -> `/var/www/html/wp'

�g�[ http://localhost/wp/ 的�Y果一�颖痪芙^存取，因�� content 的���}

[root@acer:~] ls -dZ /var/www/html/wp
drwxr-xr-x 1025 1011 root:object_r:user_home_t /var/www/html/wp/

同�拥模�我��可以用 chone -R 指令�硇拚� content

[root@acer:~] chcon -R -u system_u -t httpd_sys_content_t /var/www/html/wp/

或是使用 fixfiles restore 指令也可以

[root@acer:~] fixfiles restore /var/www/html/wp/

修正�^後的��r:

[root@acer:~] ls -dZ /var/www/html/wp
drwxr-xr-x apache apache system_u:object_r:httpd_sys_content_t /var/www/html/wp/