selinux 安全加強式Linux

1. 上下文（以 apache 爲例）

1）服務器端安裝 httpd

[root@server ~]# yum -y install httpd
[root@server ~]# systemctl start httpd
[root@server ~]# systemctl enable httpd

2）查看 httpd 默認目錄的上下文

[root@server ~]# ls -ldZ /var/www/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/

3）設置臨時上下文

[root@server ~]# mkdir /html

[root@server ~]# ls -ldZ /html/
drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /html/

[root@server ~]# chcon -R -t httpd_sys_content_t /html/

[root@server ~]# ls -ldZ /html/
drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 /html/

[root@server ~]# restorecon -R /html/

[root@server ~]# ls -ldZ /html/
drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /html/

[root@server ~]# # --reference 設置和目錄相同的上下文
[root@server ~]# chcon -R --reference=/var/www/html /www

4）設置永久上下文

[root@server ~]# semanage fcontext -a -t httpd_sys_content_t '/html(/.*)?'

[root@server ~]# ls -ldZ /html
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /html

[root@server ~]# restorecon -R /html/

[root@server ~]# ls -ldZ /html
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /html

2. 布爾值（以 vsftpd 爲例）

• 若是搭建了一個服務，須要在客戶端往服務裏寫東西，可是沒法寫入，按照如下步驟排查

1）檢查配置文件是否容許寫
2）檢查文件系統是否容許寫
3）檢查 selinux （上下文|布爾值）

1) 服務端安裝 vsftpd

[root@server ~]# yum -y install vsftpd
[root@server ~]# systemctl start vsftpd
[root@server ~]# systemctl enable vsftpd

2）檢查配置文件是否容許寫

[root@server ~]# vim /etc/vsftpd/vsftpd.conf

# 容許匿名上傳
anon_upload_enable=YES
anon_mkdir_write_enable=YES

3）檢查文件系統是否容許寫

[root@server ~]# ls -ld /var/ftp/
drwxr-xr-x. 4 root root 27 8月  17 14:29 /var/ftp/

[root@server ~]# cd /var/ftp/

[root@server ftp]# mkdir test

[root@server ftp]# chown -R ftp.ftp test

[root@server ftp]# ls -ld test
drwxr-xr-x. 2 ftp ftp 6 8月  17 14:48 test

4）檢查 selinux （上下文|布爾值）

[root@server ~]# getsebool -a | grep ftp
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> off
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
tftp_anon_write --> off
tftp_home_dir --> off

[root@server ftp]# setsebool -P ftpd_anon_write on

[root@server ftp]# setsebool -P ftpd_full_access on

[root@server ~]# getsebool -a | grep ftp
ftpd_anon_write --> on
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> on
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
tftp_anon_write --> off
tftp_home_dir --> off