深入学习：SELinux政策源代码分析

selinux

需积分: 13 196 浏览量更新于2024-07-17 收藏 2.88MB PDF 举报

身份认证购VIP最低享 7 折!

30元优惠券

"这是一份关于SELinux的学习资料——《SELinux Notebook2》，主要涵盖了SELinux的样本策略源代码。作者Richard Haines在文档中提供了有关SELinux的详细信息，尽管内容以英文为主，可能略显枯燥，但对于深入理解SELinux的用户来说，具有一定的学习价值。文档包含了版权信息，并遵循GNU Free Documentation License和GNU General Public License进行分发，旨在促进SELinux的研究和使用。" SELinux（Security-Enhanced Linux）是一种强制访问控制（MAC）系统，它是Linux内核的一个安全模块，旨在提高系统的安全性。它通过定义严格的策略来限制进程可以访问哪些资源，从而增强系统对恶意攻击和权限滥用的防护能力。在这份《SELinux Notebook2》中，读者可以了解到如何构建和管理SELinux策略。策略通常由一系列规则组成，这些规则定义了系统中的每个对象（如文件、网络端口等）以及进程（即程序）之间的交互方式。策略源代码是这些规则的文本表示，可以被编译成内核可理解的形式。文档中可能会涵盖以下主题： 1. **基础概念**：解释了SELinux的基本概念，如类型 Enforcement（TE）、域转换（Domain Transition）、多级安全（MLS）等。 2. **策略语言**：介绍如何使用SELinux的策略语言（如SELinux Policy Language）编写和修改策略规则。 3. **策略编译**：指导如何使用sepolgen和checkpolicy等工具将源代码编译成二进制策略模块，以便加载到内核中。 4. **上下文和类型**：详细讨论文件、进程和其他对象的上下文（包括用户、角色、类型和级别），以及它们在策略中的作用。 5. **策略调试**：提供如何通过audit2allow、ausearch等工具分析审计日志，找出策略错误并修复的方法。 6. **应用配置**：介绍如何为特定应用程序或服务定制SELinux策略，以确保它们能在受控环境中安全运行。 7. **故障排查**：讨论遇到SELinux错误时的解决步骤，如如何使用setenforce和restorecon命令临时或永久改变策略执行模式。 8. **实际案例**：可能包含一些真实世界中的例子，演示如何通过SELinux来保护系统免受常见威胁。这份笔记对于那些希望深入了解SELinux，或者需要处理SELinux相关问题的系统管理员、安全专家和开发者来说，是一份宝贵的资源。尽管阅读英文材料可能有一定难度，但从中获得的知识将有助于提升对Linux系统安全的理解和控制。

资源详情

资源推荐

The SELinux Notebook - Sample Policy Source

class db_table # userspace

class db_procedure # userspace

class db_column # userspace

class db_tuple # userspace

class db_blob # userspace

class peer

class capability2

class x_resource # userspace

class x_event # userspace

class x_synthetic_event # userspace

class x_application_data # userspace

class kernel_service

class tun_socket

class x_pointer # userspace

class x_keyboard # userspace

# ./policy/flask/initial_sids file entries

sid kernel

sid security

sid unlabeled

sid fs

sid file

sid file_labels

sid init

sid any_socket

sid port

sid netif

sid netmsg

sid node

sid igmp_packet

sid icmp_socket

sid tcp_socket

sid sysctl_modprobe

sid sysctl

sid sysctl_fs

sid sysctl_kernel

sid sysctl_net

sid sysctl_net_unix

sid sysctl_vm

sid sysctl_dev

sid kmod

sid policy

sid scmp_packet

sid devnull

# ./policy/flask/access_vectors file entries

common file { ioctl read write create getattr setattr lock relabelfrom relabelto

append unlink link rename execute swapon quotaon mounton }

common socket { ioctl read write create getattr setattr lock relabelfrom

relabelto append bind connect listen accept getopt setopt shutdown recvfrom

sendto recv_msg send_msg name_bind }

common ipc { create destroy getattr setattr read write associate unix_read

unix_write }

common database { create drop getattr setattr relabelfrom relabelto }

common x_device { getattr setattr use read write getfocus setfocus bell

force_cursor freeze grab manage list_property get_property set_property add

remove create destroy }

# Define the access vectors.

class filesystem { mount remount unmount getattr relabelfrom relabelto

transition associate quotamod quotaget }

class dir inherits file { add_name remove_name reparent search rmdir open }

class file inherits file { execute_no_trans entrypoint execmod open }

class lnk_file inherits file

class chr_file inherits file { execute_no_trans entrypoint execmod open }

class blk_file inherits file { open }

class sock_file inherits file { open }

class fifo_file inherits file { open }

class fd { use }

class socket inherits socket

class tcp_socket inherits socket { connectto newconn acceptfrom node_bind

name_connect }

class udp_socket inherits socket { node_bind }

class rawip_socket inherits socket { node_bind }

Page 16

The SELinux Notebook - Sample Policy Source

class node { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send

enforce_dest dccp_recv dccp_send recvfrom sendto }

class netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send

dccp_recv dccp_send ingress egress }

class netlink_socket inherits socket

class packet_socket inherits socket

class key_socket inherits socket

class unix_stream_socket inherits socket { connectto newconn acceptfrom }

class unix_dgram_socket inherits socket

class process { fork transition sigchld sigkill sigstop signull signal ptrace

getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec

setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent

execmem execstack execheap setkeycreate setsockcreate }

class ipc inherits ipc

class sem inherits ipc

class msgq inherits ipc { enqueue }

class msg { send receive }

class shm inherits ipc { lock }

class security { compute_av compute_create compute_member check_context

load_policy compute_relabel compute_user setenforce setbool setsecparam

setcheckreqprot }

class system { ipc_info syslog_read syslog_mod syslog_console module_request }

class capability { chown dac_override dac_read_search fowner fsetid kill setgid

setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw

ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct

sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease

audit_write audit_control setfcap }

class capability2 { mac_override mac_admin }

class passwd { passwd chfn chsh rootok crontab }

class x_drawable { create destroy read write blend getattr setattr list_child

add_child remove_child list_property get_property set_property manage override

show hide send receive }

class x_screen { getattr setattr hide_cursor show_cursor saver_getattr

saver_setattr saver_hide saver_show }

class x_gc { create destroy getattr setattr use }

class x_font { create destroy getattr add_glyph remove_glyph use }

class x_colormap { create destroy read write getattr add_color remove_color

install uninstall use }

class x_property { create destroy read write append getattr setattr }

class x_selection { read write getattr setattr }

class x_cursor { create destroy read write getattr setattr use }

class x_client { destroy getattr setattr manage }

class x_device inherits x_device

class x_server { getattr setattr record debug grab manage }

class x_extension { query use }

class x_resource { read write }

class x_event { send receive }

class x_synthetic_event { send receive }

class netlink_route_socket inherits socket { nlmsg_read nlmsg_write }

class netlink_firewall_socket inherits socket { nlmsg_read nlmsg_write }

class netlink_tcpdiag_socket inherits socket { nlmsg_read nlmsg_write }

class netlink_nflog_socket inherits socket

class netlink_xfrm_socket inherits socket { nlmsg_read nlmsg_write }

class netlink_selinux_socket inherits socket

class netlink_audit_socket inherits socket { nlmsg_read nlmsg_write nlmsg_relay

nlmsg_readpriv nlmsg_tty_audit }

class netlink_ip6fw_socket inherits socket { nlmsg_read nlmsg_write }

class netlink_dnrt_socket inherits socket

class dbus { acquire_svc send_msg }

class nscd { getpwd getgrp gethost getstat admin shmempwd shmemgrp shmemhost

getserv shmemserv }

class association { sendto recvfrom setcontext polmatch }

class netlink_kobject_uevent_socket inherits socket

class appletalk_socket inherits socket

class packet { send recv relabelto flow_in flow_out forward_in forward_out }

class key { view read write search link setattr create }

class context { translate contains }

class dccp_socket inherits socket { node_bind name_connect }

class memprotect { mmap_zero }

class db_database inherits database { access install_module load_module

get_param set_param }

class db_table inherits database { use select update insert delete lock }

class db_procedure inherits database { execute entrypoint install }

class db_column inherits database { use select update insert }

class db_tuple { relabelfrom relabelto use select update insert delete }

Page 17

The SELinux Notebook - Sample Policy Source

class db_blob inherits database { read write import export }

class peer { recv }

class x_application_data { paste paste_after_confirm copy }

class kernel_service { use_as_override create_files_as }

class tun_socket inherits socket

class x_pointer inherits x_device

class x_keyboard inherits x_device

###################### End of FLASK Entries #######################

# This policycap statement will be used in a netlabel module exercise

# to show network_peer_controls. For now comment out:

# policycap network_peer_controls;

# The only type defined for this policy:

type unconfined_t;

# The only role defined for this policy:

role unconfined_r types { unconfined_t };

# These allow rules enable all of the objects to access all of their

# permissions. This effectively gives access to everything.

allow unconfined_t self:security *;

allow unconfined_t self:process *;

allow unconfined_t self:system *;

allow unconfined_t self:capability *;

allow unconfined_t self:filesystem *;

allow unconfined_t self:file *;

allow unconfined_t self:dir *;

allow unconfined_t self:fd *;

allow unconfined_t self:lnk_file *;

allow unconfined_t self:chr_file *;

allow unconfined_t self:blk_file *;

allow unconfined_t self:sock_file *;

allow unconfined_t self:fifo_file *;

allow unconfined_t self:socket *;

allow unconfined_t self:tcp_socket *;

allow unconfined_t self:udp_socket *;

allow unconfined_t self:rawip_socket *;

allow unconfined_t self:node *;

allow unconfined_t self:netif *;

allow unconfined_t self:netlink_socket *;

allow unconfined_t self:packet_socket *;

allow unconfined_t self:key_socket *;

allow unconfined_t self:unix_stream_socket *;

allow unconfined_t self:unix_dgram_socket *;

allow unconfined_t self:sem *;

allow unconfined_t self:msg *;

allow unconfined_t self:msgq *;

allow unconfined_t self:shm *;

allow unconfined_t self:ipc *;

allow unconfined_t self:passwd *;

allow unconfined_t self:x_drawable *;

allow unconfined_t self:x_screen *;

allow unconfined_t self:x_gc *;

allow unconfined_t self:x_font *;

allow unconfined_t self:x_colormap *;

allow unconfined_t self:x_property *;

allow unconfined_t self:x_selection *;

allow unconfined_t self:x_cursor *;

allow unconfined_t self:x_client *;

allow unconfined_t self:x_device *;

allow unconfined_t self:x_server *;

allow unconfined_t self:x_extension *;

allow unconfined_t self:netlink_route_socket *;

allow unconfined_t self:netlink_firewall_socket *;

allow unconfined_t self:netlink_tcpdiag_socket *;

allow unconfined_t self:netlink_nflog_socket *;

allow unconfined_t self:netlink_xfrm_socket *;

allow unconfined_t self:netlink_selinux_socket *;

allow unconfined_t self:netlink_audit_socket *;

Page 18

The SELinux Notebook - Sample Policy Source

allow unconfined_t self:netlink_ip6fw_socket *;

allow unconfined_t self:netlink_dnrt_socket *;

allow unconfined_t self:dbus *;

allow unconfined_t self:nscd *;

allow unconfined_t self:association *;

allow unconfined_t self:netlink_kobject_uevent_socket *;

allow unconfined_t self:appletalk_socket *;

allow unconfined_t self:packet *;

allow unconfined_t self:key *;

allow unconfined_t self:context *;

allow unconfined_t self:dccp_socket *;

allow unconfined_t self:memprotect *;

allow unconfined_t self:db_database *;

allow unconfined_t self:db_table *;

allow unconfined_t self:db_procedure *;

allow unconfined_t self:db_column *;

allow unconfined_t self:db_tuple *;

allow unconfined_t self:db_blob *;

allow unconfined_t self:peer *;

allow unconfined_t self:capability2 *;

allow unconfined_t self:x_resource *;

allow unconfined_t self:x_event *;

allow unconfined_t self:x_synthetic_event *;

allow unconfined_t self:x_application_data *;

allow unconfined_t self:kernel_service *;

allow unconfined_t self:tun_socket *;

allow unconfined_t self:x_pointer *;

allow unconfined_t self:x_keyboard *;

# The only real SELinux user defined for this policy:

user user_u roles { unconfined_r };

# The system_u user is defined so that objects can be labeled with

# system_u:object_r as in standard policies, also so that semanage can add

# ports etc. as it requires a system_u user for adding these type of objects.

user system_u roles { unconfined_r };

# This role constraint statement will be used to show limiting

# a role transition in the external gateway. For now comment out:

# constrain process transition ( r1 == r2 );

# These are the default labeling operations for these objects.

# Note that the kernel entry is unconfined_r not object_r

sid kernel system_u:unconfined_r:unconfined_t

sid security system_u:object_r:unconfined_t

sid unlabeled system_u:object_r:unconfined_t

sid fs system_u:object_r:unconfined_t

sid file system_u:object_r:unconfined_t

sid file_labels system_u:object_r:unconfined_t

sid init system_u:object_r:unconfined_t

sid any_socket system_u:object_r:unconfined_t

sid port system_u:object_r:unconfined_t

sid netif system_u:object_r:unconfined_t

sid netmsg system_u:object_r:unconfined_t

sid node system_u:object_r:unconfined_t

sid igmp_packet system_u:object_r:unconfined_t

sid icmp_socket system_u:object_r:unconfined_t

sid tcp_socket system_u:object_r:unconfined_t

sid sysctl_modprobe system_u:object_r:unconfined_t

sid sysctl system_u:object_r:unconfined_t

sid sysctl_fs system_u:object_r:unconfined_t

sid sysctl_kernel system_u:object_r:unconfined_t

sid sysctl_net system_u:object_r:unconfined_t

sid sysctl_net_unix system_u:object_r:unconfined_t

sid sysctl_vm system_u:object_r:unconfined_t

sid sysctl_dev system_u:object_r:unconfined_t

sid kmod system_u:object_r:unconfined_t

sid policy system_u:object_r:unconfined_t

sid scmp_packet system_u:object_r:unconfined_t

sid devnull system_u:object_r:unconfined_t

Page 19

剩余167页未读，继续阅读

qq_33689226

粉丝: 5
资源: 9

深入学习：SELinux政策源代码分析

SELinux详解-中文版.pdf

SELinux中文.pdf

selinux-notebook:SELinux笔记本

policycoreutils-python 被 container-selinux-2:2.119.2-1.911c772.el7_8.noarch

python2 禁用SELinux

虚拟机关闭selinux命令

ansible使用selinux模块关闭selinux

cenos7关闭selinux并禁止selinux开机启动

centos7.6 关闭selinux

petalinux 2022.2 取消selinux

修改selinux配置文件

Linux selinux 怎么安装

关闭Ubuntu的selinux

linux selinux 命令工具

如何关闭selinux

ubuntu20.04关闭selinux

shell脚本配置selinux

关闭selinux权限命令

centos怎么关闭selinux

rockylinux9.0关闭selinux

最新资源