Linux安全指南：强化6.2版系统安全

需积分: 9 20 浏览量更新于2024-07-25 收藏 682KB PDF 举报

本文档是关于"Red Hat Enterprise Linux 6.2 Beta Security-Enhanced Linux User Guide"的第二版，由Red Hat, Inc.撰写并授权，遵循Creative Commons Attribution-ShareAlike 3.0 Unported (CC-BY-SA) 许可协议。这个文档旨在提供Linux操作系统的深度安全知识，特别关注于Security-Enhanced Linux (SELinux)，这是一种增强Linux系统安全性的技术，针对企业级环境中的安全性提供了额外的保障。在Linux 6.2 Beta的这个用户指南中，读者可以了解到以下关键知识点： 1. **SELinux概述**：SELinux是一种强制访问控制（MAC）机制，它基于类型强制安全模型，通过将系统中的每个实体（如进程、文件和网络套接字）分配一个或多个安全上下文（type contexts），来限制不同实体之间的交互，从而防止未经授权的操作。 2. **安装与配置**：文档详细指导如何在Red Hat Enterprise Linux上启用和配置SELinux，包括设置默认策略、管理规则文件以及调整系统以适应特定的安全需求。 3. **基本概念**：包括安全级别（security levels）、目标上下文（target contexts）和角色（roles），这些都是理解SELinux工作原理的关键。 4. **策略定制**：如何创建、修改和管理SELinux策略模块，以适应组织的特定业务流程和安全要求。 5. **审计与日志**：了解如何配置和分析SELinux日志，以便跟踪和响应潜在的安全威胁。 6. **兼容性和集成**：文档还涵盖了SELinux与其他系统组件（如Java、XFS等）的协同工作，以及与非SELinux系统之间的交互方式。 7. **安全最佳实践**：提供了一系列的安全建议，帮助用户在日常操作中实施和维护SELinux以提高整体系统安全性。 8. **法律与许可**：强调了CC-BY-SA许可证的适用性，明确了在分享、改编和分发文档时的版权要求和限制。这是一份实用的资源，对于希望强化Linux系统安全性的管理员和开发者来说，无论是初学者还是经验丰富的专业人士，都能从中获益匪浅。通过学习和应用这份指南，用户可以更好地理解和管理其系统的安全状态，确保在Red Hat Enterprise Linux环境中实现高效且安全的操作。

Chapter 2. Introduction

2.3. SELinux Architecture

SELinux is a Linux security module that is built into the Linux kernel. SELinux is driven by loadable

policy rules. When security-relevant access is taking place, such as when a process attempts to

open a file, the operation is intercepted in the kernel by SELinux. If an SELinux policy rule allows the

operation, it continues, otherwise, the operation is blocked and the process receives an error.

SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the

Access Vector Cache (AVC). Caching decisions decrease how often SELinux policy rules need to be

checked, which increases performance. Remember that SELinux policy rules have no effect if DAC

rules deny access first.

2.4. SELinux on Other Operating Systems

Refer to the following for information about running SELinux on other Linux distributions:

• Hardened Gentoo: http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml.

• Debian: http://wiki.debian.org/SELinux.

• Ubuntu: https://wiki.ubuntu.com/SELinux and https://help.ubuntu.com/community/SELinux.

• Fedora: http://fedoraproject.org/wiki/SELinux and the Fedora SELinux FAQ

Chapter 3.

SELinux Contexts

Processes and files are labeled with an SELinux context that contains additional information, such as

an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is

used to make access control decisions. In Red Hat Enterprise Linux, SELinux provides a combination

of Role-Based Access Control (RBAC), Type Enforcement® (TE), and, optionally, Multi-Level Security

(MLS).

The following is an example showing SELinux context. SELinux contexts are used on processes,

Linux users, and files, on Linux operating systems that run SELinux. Use the ls -Z command to view

the SELinux context of files and directories:

$ ls -Z file1

-rwxrw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1

SELinux contexts follow the SELinux user:role:type:level syntax:

SELinux user

The SELinux user identity is an identity known to the policy that is authorized for a specific set of

roles, and for a specific MLS range. Each Linux user is mapped to an SELinux user via SELinux

policy. This allows Linux users to inherit the restrictions placed on SELinux users. The mapped

SELinux user identity is used in the SELinux context for processes in that session, in order to

define what roles and levels they can enter. Run the semanage login -l command as the

Linux root user to view a list of mappings between SELinux and Linux user accounts:

# /usr/sbin/semanage login -l

__default__ unconfined_u s0-s0:c0.c1023

root unconfined_u s0-s0:c0.c1023

system_u system_u s0-s0:c0.c1023

Output may differ slightly from system to system. The Login Name column lists Linux users, and

the SELinux User column lists which SELinux user the Linux user is mapped to. For processes,

the SELinux user limits which roles and levels are accessible. The last column, MLS/MCS Range,

is the level used by Multi-Level Security (MLS) and Multi-Category Security (MCS). Levels are

briefly discussed later.

role

Part of SELinux is the Role-Based Access Control (RBAC) security model. The role is an attribute

of RBAC. SELinux users are authorized for roles, and roles are authorized for domains. The role

serves as an intermediary between domains and SELinux users. The roles that can be entered

determine which domains can be entered - ultimately, this controls which object types can be

accessed. This helps reduce vulnerability to privilege escalation attacks.

type

The type is an attribute of Type Enforcement. The type defines a domain for processes, and a type

for files. SELinux policy rules define how types can access each other, whether it be a domain

accessing a type, or a domain accessing another domain. Access is only allowed if a specific

SELinux policy rule exists that allows it.

level

The level is an attribute of MLS and Multi-Category Security (MCS). An MLS range is a pair of

levels, written as lowlevel-highlevel if the levels differ, or lowlevel if the levels are identical (s0-s0

Chapter 3. SELinux Contexts

is the same as s0). Each level is a sensitivity-category pair, with categories being optional. If there

are categories, the level is written as sensitivity:category-set. If there are no categories, it is written

as sensitivity.

If the category set is a contiguous series, it can be abbreviated. For example, c0.c3 is the same

as c0,c1,c2,c3. The /etc/selinux/targeted/setrans.conf file maps levels (s0:c0)

to human-readable form (ie. CompanyConfidential). Do not edit setrans.conf with a text

editor: use semanage to make changes. Refer to the semanage(8) manual page for further

information. In Red Hat Enterprise Linux, targeted policy enforces MCS, and in MCS, there is

just one sensitivity, s0. MCS in Red Hat Enterprise Linux supports 1024 different categories: c0

through to c1023. s0-s0:c0.c1023 is sensitivity s0 and authorized for all categories.

MLS enforces the Bell-La Padula Mandatory Access Model

, and is used in Labeled Security

Protection Profile (LSPP) environments. To use MLS restrictions, install the selinux-policy-mls

package, and configure MLS to be the default SELinux policy. The MLS policy shipped with

Red Hat Enterprise Linux omits many program domains that were not part of the evaluated

configuration, and therefore, MLS on a desktop workstation is unusable (no support for the X

Window System); however, an MLS policy from the upstream SELinux Reference Policy

can be

built that includes all program domains.

3.1. Domain Transitions

A process in one domain transitions to another domain by executing an application that has the

entrypoint type for the new domain. The entrypoint permission is used in SELinux policy, and

controls which applications can be used to enter a domain. The following example demonstrates a

domain transition:

1. A user wants to change their password. To do this, they run the passwd application. The /usr/

bin/passwd executable is labeled with the passwd_exec_t type:

$ ls -Z /usr/bin/passwd

-rwsr-xr-x root root system_u:object_r:passwd_exec_t:s0 /usr/bin/passwd

The passwd application accesses /etc/shadow, which is labeled with the shadow_t type:

$ ls -Z /etc/shadow

-r--------. root root system_u:object_r:shadow_t:s0 /etc/shadow

2. An SELinux policy rule states that processes running in the passwd_t domain are allowed to read

and write to files labeled with the shadow_t type. The shadow_t type is only applied to files that

are required for a password change. This includes /etc/gshadow, /etc/shadow, and their

backup files.

3. An SELinux policy rule states that the passwd_t domain has entrypoint permission to the

passwd_exec_t type.

4. When a user runs the /usr/bin/passwd application, the user's shell process transitions to the

passwd_t domain. With SELinux, since the default action is to deny, and a rule exists that allows

(among other things) applications running in the passwd_t domain to access files labeled with

the shadow_t type, the passwd application is allowed to access /etc/shadow, and update the

user's password.

http://en.wikipedia.org/wiki/Bell-LaPadula_model

http://oss.tresys.com/projects/refpolicy

SELinux Contexts for Processes

This example is not exhaustive, and is used as a basic example to explain domain transition. Although

there is an actual rule that allows subjects running in the passwd_t domain to access objects labeled

with the shadow_t file type, other SELinux policy rules must be met before the subject can transition

to a new domain. In this example, Type Enforcement ensures:

• the passwd_t domain can only be entered by executing an application labeled with the

passwd_exec_t type; can only execute from authorized shared libraries, such as the lib_t type;

and can not execute any other applications.

• only authorized domains, such as passwd_t, can write to files labeled with the shadow_t type.

Even if other processes are running with superuser privileges, those processes can not write to files

labeled with the shadow_t type, as they are not running in the passwd_t domain.

• only authorized domains can transition to the passwd_t domain. For example, the sendmail

process running in the sendmail_t domain does not have a legitimate reason to execute passwd;

therefore, it can never transition to the passwd_t domain.

• processes running in the passwd_t domain can only read and write to authorized types, such as

files labeled with the etc_t or shadow_t types. This prevents the passwd application from being

tricked into reading or writing arbitrary files.

3.2. SELinux Contexts for Processes

Use the ps -eZ command to view the SELinux context for processes. For example:

Open a terminal, such as Applications → System Tools → Terminal.

2. Run the /usr/bin/passwd command. Do not enter a new password.

3. Open a new tab, or another terminal, and run the ps -eZ | grep passwd command. The

output is similar to the following:

unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 13212 pts/1 00:00:00 passwd

4. In the first tab/terminal, press Ctrl+C to cancel the passwd application.

In this example, when the /usr/bin/passwd application (labeled with the passwd_exec_t type) is

executed, the user's shell process transitions to the passwd_t domain. Remember: the type defines a

domain for processes, and a type for files.

Use the ps -eZ command to view the SELinux contexts for running processes. The following is a

truncated example of the output, and may differ on your system:

system_u:system_r:dhcpc_t:s0 1869 ? 00:00:00 dhclient

system_u:system_r:sshd_t:s0-s0:c0.c1023 1882 ? 00:00:00 sshd

system_u:system_r:gpm_t:s0 1964 ? 00:00:00 gpm

system_u:system_r:crond_t:s0-s0:c0.c1023 1973 ? 00:00:00 crond

system_u:system_r:kerneloops_t:s0 1983 ? 00:00:05 kerneloops

system_u:system_r:crond_t:s0-s0:c0.c1023 1991 ? 00:00:00 atd

The system_r role is used for system processes, such as daemons. Type Enforcement then

separates each domain.

3.3. SELinux Contexts for Users

Use the id -Z command to view the SELinux context associated with your Linux user:

剩余81页未读，继续阅读

wddfwl

粉丝: 0
资源: 8

Linux安全指南：强化6.2版系统安全

linux入门文档全集

Linux帮助文档大全

Linux安全配置+安全+Linux文档

linuxChm文档

linux文档

linux-文档_linux_linux编程_源码.zip

ArcGIS Server Linux安装文档

LINUX学习文档.rar

kali-linux 官方文档

Linux内核文档（一）

最新资源