As SELinux is a bit of complicated compared to the tools that we use currently, I have thought it is good to have some tips here.
1) seinfo: This is the selinux query tool to see statistics about your policy.
| [root@rh54-3 ~]# seinfo
Statistics for policy file: /etc/selinux/targeted/policy/policy.21 Classes: 61 Permissions: 220 |
2) sesearch: This is a very handy tool. When I started using SELinux, I was thinking that processes with a specific type are only allowed to make operations of the same type:) how stupid I am. Then I have seen by experience that policy can defines it and to see what a source can do, we can use sesearch. For example to search for httpd_t type source in order to see in which types it is associated with issue the following;
| [root@rh54-3 ~]# sesearch -s httpd_t -c file –allow Found 103 av rules: allow httpd_t etc_runtime_t : file { ioctl read getattr lock }; allow httpd_t httpd_var_lib_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow httpd_t httpd_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock }; allow httpd_t public_content_rw_t : file { ioctl read getattr lock }; allow httpd_t httpd_bugzilla_htaccess_t : file { ioctl read getattr lock }; allow httpd_t mailman_data_t : file { ioctl read getattr lock }; allow httpd_t httpd_cvs_htaccess_t : file { ioctl read getattr lock }; allow httpd_t httpd_sys_htaccess_t : file { ioctl read getattr lock }; allow httpd_t squirrelmail_spool_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow httpd_t httpd_prewikka_htaccess_t : file { ioctl read getattr lock }; allow httpd_t locale_t : file { ioctl read getattr lock }; allow httpd_t var_auth_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow httpd_t etc_t : file { ioctl read getattr lock }; allow httpd_t fonts_t : file { ioctl read getattr lock }; allow httpd_t ld_so_t : file { ioctl read getattr lock execute }; allow httpd_t proc_t : file { ioctl read getattr lock }; allow httpd_t sysfs_t : file { ioctl read getattr lock }; allow httpd_t krb5_keytab_t : file { ioctl read getattr lock }; allow httpd_t httpd_config_t : file { ioctl read getattr lock }; allow httpd_t udev_tbl_t : file { ioctl read getattr lock }; allow httpd_t httpd_tmp_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow httpd_t shell_exec_t : file { ioctl read getattr lock execute execute_no_trans }; allow httpd_t cvs_data_t : file { ioctl read getattr lock }; allow httpd_t httpd_helper_exec_t : file { read getattr execute }; allow httpd_t ld_so_cache_t : file { ioctl read getattr lock }; allow httpd_t httpd_squirrelmail_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow httpd_t httpd_php_exec_t : file { read getattr execute }; allow httpd_t httpd_nagios_htaccess_t : file { ioctl read getattr lock }; allow httpd_t net_conf_t : file { ioctl read getattr lock }; … … |
3) Restorecon
This is a very useful utility that allows you to restore types configured statically in the system. The only thing you should do is
| #restorecon -R -v /data |
However if your type is in /etc/selinux/targeted/contexts/customizable_types file then you have to add “-F” flag into the command, if you don’t nothing happens:) As I have quoted text from Dan Walsh’s blog (RH engineer) , restorecon ignores these types and -F must be added.
- customizable_types
- These are a list of file types that restorecon will ignore. So if you want to relabel your entire system using restorecon, and a file is labeled with a context in this file, the context will not be changed. This can be overridden with the -F flag. This allows you to specify special directories on your system as being readable by apache. So if you chcon -R -t httpd_sys_content_t /var/myhtml, a relabel will not change this directory tree back to var_t.
Selinux User Guide: http://docs.fedoraproject.org/selinux-user-guide/f12/en-US/index.html
ANGEL wrote:
PillSpot.org. Canadian Health&Care.No prescription online pharmacy.Special Internet Prices.Pillspot.org. Vitamins@buy.online” rel=”nofollow”>.…
Categories: Stomach.Antibiotics.Pain Relief.Blood Pressure/Heart.Weight Loss.Anxiety/Sleep Aid.Womens Health.Mental HealthAntiviral.Mens Health.Antidiabetic.Eye Care.Vitamins/Herbal Supplements.Skin Care.Stop SmokingAnti-allergic/Asthma.Antidepres…
Link | June 27th, 2010 at 3:52 pm
1 wrote:
1 http://04FORDPARTS.US/tag/1 : 18 Accessories Cars 118/…
1…
Link | August 29th, 2010 at 8:03 am
Laptop wrote:
Apple http://rdelta0gc.copious-systems.com/tag/laptop+Apple+Laptop/ : Laptop…
Apple…
Link | August 29th, 2010 at 10:31 am
of wrote:
Requirements http://cwarcraftlnm0i6.copious-systems.com/tag/Requirements+Computer+of/ : of…
Computer…
Link | August 29th, 2010 at 9:23 pm
bega wrote:
lighting http://qwood6qi.02JEEPPARTS.US/tag/bega+lighting+Lighting/ : Lighting…
lighting…
Link | August 29th, 2010 at 9:40 pm
smokeless wrote:
Products http://isanyok9n.APTAUTOPARTS.INFO/tag/Products+smokeless+sanyo/ : smokeless…
sanyo…
Link | August 30th, 2010 at 2:24 am