{"id":36129,"date":"2019-10-31T22:09:46","date_gmt":"2019-10-31T19:09:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chasto-zadavaemye-voprosy-po-selinux-faq\/"},"modified":"2019-10-31T22:09:46","modified_gmt":"2019-10-31T19:09:46","slug":"chasto-zadavaemye-voprosy-po-selinux-faq","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chasto-zadavaemye-voprosy-po-selinux-faq","title":{"rendered":"\u010casto kladen\u00e9 dotazy k SELinux (FAQ)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ahoj v\u0161em! Speci\u00e1ln\u011b pro studenty kurzu <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/k52L\/\">\u201eBezpe\u010dnost Linuxu\u201c<\/a><\/noindex> jsme p\u0159ipravili p\u0159eklad ofici\u00e1ln\u00edho FAQ projektu SELinux. Domn\u00edv\u00e1me se, \u017ee tento p\u0159eklad m\u016f\u017ee b\u00fdt u\u017eite\u010dn\u00fd nejen student\u016fm, proto se s v\u00e1mi o n\u011bj d\u011bl\u00edme.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u010casto kladen\u00e9 dotazy k SELinux (FAQ)\" src=\"\/wp-content\/uploads\/2019\/07\/7f244c6dca8425c20136a6774b14c752.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pok attempted jsme odpov\u011bd\u011bt na n\u011bkter\u00e9 z nej\u010dast\u011bji kladen\u00fdch ot\u00e1zek t\u00fdkaj\u00edc\u00edch se projektu SELinux. Aktu\u00e1ln\u011b jsou ot\u00e1zky rozd\u011bleny do dvou hlavn\u00edch kategori\u00ed. V\u0161echny ot\u00e1zky a odpov\u011bdi jsou uvedeny <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\/What-We-Do\/Research\/SELinux\/FAQs\/\">na str\u00e1nce FAQ<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2 id=\"obzor\">P\u0159ehled<\/h2>\n<p><\/p>\n<h3 id=\"obzor-1\">P\u0159ehled<\/h3>\n<p><\/p>\n<ol>\n<li>Co je Linux s vylep\u0161enou bezpe\u010dnost\u00ed?<br \/>\nLinux s vylep\u0161enou bezpe\u010dnost\u00ed (SELinux - Security-Enhanced Linux) je referen\u010dn\u00ed implementac\u00ed bezpe\u010dnostn\u00ed architektury Flask pro flexibiln\u00ed vynucov\u00e1n\u00ed kontroly p\u0159\u00edstupu. Byl vytvo\u0159en za \u00fa\u010delem demonstrovat u\u017eite\u010dnost flexibiln\u00edch mechanism\u016f spr\u00e1vy vynucen\u00e9ho p\u0159\u00edstupu a jak lze tyto mechanismy p\u0159idat do opera\u010dn\u00edho syst\u00e9mu. Architektura Flask byla n\u00e1sledn\u011b integrov\u00e1na do Linuxu a portov\u00e1na do n\u011bkolika dal\u0161\u00edch syst\u00e9m\u016f, v\u010detn\u011b opera\u010dn\u00edho syst\u00e9mu Solaris, opera\u010dn\u00edho syst\u00e9mu FreeBSD a j\u00e1dra Darwin, co\u017e p\u0159ineslo \u0161irok\u00e9 spektrum souvisej\u00edc\u00ed pr\u00e1ce. Architektura Flask poskytuje spole\u010dnou podporu pro aplikaci mnoha typ\u016f vynucovac\u00edch politik kontroly p\u0159\u00edstupu, v\u010detn\u011b t\u011bch, kter\u00e9 jsou zalo\u017eeny na konceptu typu vynucen\u00ed, \u0159\u00edzen\u00ed p\u0159\u00edstupu zalo\u017een\u00e9ho na rol\u00edch a v\u00edce\u00farov\u0148ov\u00e9 bezpe\u010dnosti.<\/li>\n<li>Co poskytuje Linux s vylep\u0161enou bezpe\u010dnost\u00ed, co standardn\u00ed Linux nem\u016f\u017ee?<br \/>\nJ\u00e1dro Linuxu s vylep\u0161enou bezpe\u010dnost\u00ed nastavuje politiky vynucen\u00e9ho kontroly p\u0159\u00edstupu, kter\u00e9 omezuj\u00ed u\u017eivatelsk\u00e9 programy a syst\u00e9mov\u00e9 servery na minim\u00e1ln\u00ed sadu opr\u00e1vn\u011bn\u00ed, kter\u00e1 pot\u0159ebuj\u00ed k vykon\u00e1n\u00ed sv\u00e9 pr\u00e1ce. P\u0159i tomto omezen\u00ed se sni\u017euje nebo vylu\u010duje schopnost t\u011bchto u\u017eivatelsk\u00fdch program\u016f a syst\u00e9mov\u00fdch d\u00e9mon\u016f zp\u016fsobit \u0161kody v p\u0159\u00edpad\u011b kompromitace (nap\u0159\u00edklad v d\u016fsledku p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku nebo nespr\u00e1vn\u00e9 konfigurace). Tento mechanismus omezen\u00ed funguje nez\u00e1visle na tradi\u010dn\u00edch mechanismech kontroly p\u0159\u00edstupu Linuxu. Nem\u00e1 pojem superu\u017eivatelsk\u00e9ho \u201eroot\u201c a ned\u011bl\u00ed b\u011b\u017en\u00e9 nedostatky tradi\u010dn\u00edch ochrann\u00fdch mechanism\u016f Linuxu (nap\u0159\u00edklad z\u00e1vislost na bin\u00e1rn\u00edch souborech setuid\/setgid).<br \/>\nOchrana nemodifikovan\u00e9ho syst\u00e9mu Linux z\u00e1vis\u00ed na spr\u00e1vnosti j\u00e1dra, v\u0161ech privilegovan\u00fdch aplikac\u00ed a ka\u017ed\u00e9 z jejich konfigurac\u00ed. Probl\u00e9m v kter\u00e9koliv z t\u011bchto oblast\u00ed m\u016f\u017ee v\u00e9st ke kompromitaci cel\u00e9ho syst\u00e9mu. Naopak, ochrana modifikovan\u00e9ho syst\u00e9mu zalo\u017een\u00e9ho na j\u00e1d\u0159e Linux s vylep\u0161enou bezpe\u010dnost\u00ed z\u00e1vis\u00ed p\u0159edev\u0161\u00edm na spr\u00e1vnosti j\u00e1dra a konfiguraci jeho bezpe\u010dnostn\u00ed politiky. I kdy\u017e probl\u00e9my se spr\u00e1vnost\u00ed nebo konfigurac\u00ed aplikac\u00ed mohou umo\u017enit omezenou kompromitaci jednotliv\u00fdch u\u017eivatelsk\u00fdch program\u016f a syst\u00e9mov\u00fdch d\u00e9mon\u016f, nep\u0159edstavuj\u00ed bezpe\u010dnostn\u00ed hrozbu pro ostatn\u00ed u\u017eivatelsk\u00e9 programy a syst\u00e9mov\u00e9 d\u00e9mony nebo bezpe\u010dnost syst\u00e9mu jako celku.<\/li>\n<li>Na co se to hod\u00ed?<br \/>\nNov\u00e9 funkce Linuxu s vylep\u0161enou bezpe\u010dnost\u00ed jsou ur\u010deny k zaji\u0161t\u011bn\u00ed odd\u011blen\u00ed informac\u00ed na z\u00e1klad\u011b po\u017eadavk\u016f na d\u016fv\u011brnost a integritu. Maj\u00ed za c\u00edl zabr\u00e1nit proces\u016fm v \u010dten\u00ed dat a program\u016f, fal\u0161ov\u00e1n\u00ed dat a program\u016f, obch\u00e1zen\u00ed bezpe\u010dnostn\u00edch mechanism\u016f aplikac\u00ed, spou\u0161t\u011bn\u00ed nespolehliv\u00fdch program\u016f nebo zasahov\u00e1n\u00ed do jin\u00fdch proces\u016f, co\u017e poru\u0161uje bezpe\u010dnostn\u00ed politiku syst\u00e9mu. Pom\u00e1haj\u00ed tak\u00e9 omezit potenci\u00e1ln\u00ed \u0161kody, kter\u00e9 mohou zp\u016fsobit \u0161kodliv\u00e9 nebo nekorektn\u00ed programy. M\u011bly by tak\u00e9 b\u00fdt u\u017eite\u010dn\u00e9 pro umo\u017en\u011bn\u00ed pou\u017e\u00edv\u00e1n\u00ed jednoho syst\u00e9mu u\u017eivateli s r\u016fzn\u00fdmi bezpe\u010dnostn\u00edmi opr\u00e1vn\u011bn\u00edmi k p\u0159\u00edstupu k r\u016fzn\u00fdm druh\u016fm informac\u00ed s r\u016fzn\u00fdmi bezpe\u010dnostn\u00edmi po\u017eadavky, ani\u017e by do\u0161lo k po\u0161kozen\u00ed t\u011bchto po\u017eadavk\u016f.<\/li>\n<li>Jak mohu z\u00edskat kopii?<br \/>\nMnoho distribuc\u00ed Linuxu zahrnuje podporu SELinux ji\u017e vestav\u011bnou jako v\u00fdchoz\u00ed funkci nebo jako voliteln\u00fd bal\u00ed\u010dek. Z\u00e1kladn\u00ed k\u00f3d u\u017eivatelsk\u00e9ho prostoru SELinux je dostupn\u00fd na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SELinuxProject\">GitHub<\/a><\/noindex>. Koncov\u00ed u\u017eivatel\u00e9 by obvykle m\u011bli pou\u017e\u00edvat bal\u00ed\u010dky poskytovan\u00e9 jejich distribuc\u00ed.<\/li>\n<li>Co je sou\u010d\u00e1st\u00ed va\u0161eho vyd\u00e1n\u00ed?<br \/>\nRelease NSA SELinux zahrnuje z\u00e1kladn\u00ed k\u00f3d u\u017eivatelsk\u00e9ho prostoru SELinux. Podpora SELinux je ji\u017e zahrnuta v hlavn\u00edm j\u00e1d\u0159e Linux 2.6, dostupn\u00e9m na kernel.org. Z\u00e1kladn\u00ed k\u00f3d u\u017eivatelsk\u00e9ho prostoru SELinux se skl\u00e1d\u00e1 z knihovny pro manipulaci s bin\u00e1rn\u00edmi politikami (libsepol), kompileru politiky (checkpolicy), knihovny pro aplikace zabezpe\u010duj\u00edc\u00ed bezpe\u010dnost (libselinux), knihovny pro n\u00e1stroje spr\u00e1vy politiky (libsemanage) a n\u011bkolika souvisej\u00edc\u00edch utilit (policycoreutils).<br \/>\nKrom\u011b j\u00e1dra s podporou SELinux a z\u00e1kladn\u00edho k\u00f3du u\u017eivatelsk\u00e9ho prostoru budete pot\u0159ebovat politiku a n\u011bkter\u00e9 upraven\u00e9 bal\u00ed\u010dky u\u017eivatelsk\u00e9ho prostoru pro pou\u017eit\u00ed SELinux. Politiku lze z\u00edskat z <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TresysTechnology\/refpolicy\/wiki\">projektu referen\u010dn\u00ed politiky SELinux<\/a><\/noindex>. <\/li>\n<li>Mohu nainstalovat Linux s vylep\u0161enou ochranou na existuj\u00edc\u00ed syst\u00e9m Linux?<br \/>\nAno, m\u016f\u017eete nainstalovat pouze modifikace SELinux na existuj\u00edc\u00ed syst\u00e9m Linux, nebo m\u016f\u017eete nainstalovat distribuci Linuxu, kter\u00e1 ji\u017e zahrnuje podporu SELinux. SELinux se skl\u00e1d\u00e1 z j\u00e1dra Linuxu s podporou SELinux, z\u00e1kladn\u00edho souboru knihoven a utilit, n\u011bkter\u00fdch modifikovan\u00fdch u\u017eivatelsk\u00fdch bal\u00ed\u010dk\u016f a konfigurace politiky. Abyste jej nainstalovali do existuj\u00edc\u00edho syst\u00e9mu Linux, ve kter\u00e9m chyb\u00ed podpora SELinux, mus\u00edte m\u00edt mo\u017enost zkompilovat software a m\u00edt dal\u0161\u00ed pot\u0159ebn\u00e9 syst\u00e9mov\u00e9 bal\u00ed\u010dky. Pokud va\u0161e distribuce Linux ji\u017e obsahuje podporu SELinux, nemus\u00edte sestavovat ani instalovat release NSA SELinux.<\/li>\n<li>Jak kompatibiln\u00ed je Linux s vylep\u0161enou bezpe\u010dnost\u00ed s nemodifikovan\u00fdm Linuxem?<br \/>\nLinux s vylep\u0161enou bezpe\u010dnost\u00ed zaji\u0161\u0165uje bin\u00e1rn\u00ed kompatibilitu s existuj\u00edc\u00edmi aplikacemi Linuxu a s existuj\u00edc\u00edmi moduly j\u00e1dra Linuxu, ale n\u011bkter\u00e9 moduly j\u00e1dra mohou vy\u017eadovat modifikace pro spr\u00e1vnou interakci se SELinux. Tyto dv\u011b kategorie kompatibility jsou podrobn\u011b probr\u00e1ny n\u00ed\u017ee:<\/p>\n<ul>\n<li>Kompatibilita aplikac\u00ed<br \/>\nSELinux zaji\u0161\u0165uje bin\u00e1rn\u00ed kompatibilitu se st\u00e1vaj\u00edc\u00edmi aplikacemi. Roz\u0161\u00ed\u0159ili jsme datov\u00e9 struktury j\u00e1dra o nov\u00e9 atributy ochrany a p\u0159idali nov\u00e9 API pro aplikace zaji\u0161\u0165uj\u00edc\u00ed bezpe\u010dnost. Nicm\u00e9n\u011b jsme nezm\u011bnili \u017e\u00e1dn\u00e9 datov\u00e9 struktury viditeln\u00e9 pro aplikace a nezas\u00e1hli jsme do rozhran\u00ed existuj\u00edc\u00edch syst\u00e9mov\u00fdch vol\u00e1n\u00ed, tak\u017ee st\u00e1vaj\u00edc\u00ed aplikace mohou fungovat bez zm\u011bn, pokud bezpe\u010dnostn\u00ed politika umo\u017e\u0148uje jejich spou\u0161t\u011bn\u00ed.<\/li>\n<li>Kompatibilita modul\u016f j\u00e1dra<br \/>\nP\u016fvodn\u011b SELinux poskytoval z\u00e1kladn\u00ed kompatibilitu pouze pro st\u00e1vaj\u00edc\u00ed moduly j\u00e1dra; bylo t\u0159eba tyto moduly znovu zkompilovat na zm\u011bn\u011bn\u00fdch hlavi\u010dk\u00e1ch j\u00e1dra, aby zahrnuly nov\u00e9 ochrann\u00e9 pole p\u0159idan\u00e9 do datov\u00fdch struktur j\u00e1dra. Vzhledem k tomu, \u017ee LSM a SELinux jsou nyn\u00ed integrov\u00e1ny do hlavn\u00edho j\u00e1dra Linuxu 2.6, SELinux nyn\u00ed zaji\u0161\u0165uje bin\u00e1rn\u00ed kompatibilitu se st\u00e1vaj\u00edc\u00edmi moduly j\u00e1dra. Nicm\u00e9n\u011b n\u011bkter\u00e9 moduly j\u00e1dra mohou s SELinuxem \u0161patn\u011b spolupracovat bez zm\u011bn. Nap\u0159\u00edklad pokud modul j\u00e1dra p\u0159\u00edmo alokuje a nastavuje objekt j\u00e1dra bez pou\u017eit\u00ed b\u011b\u017en\u00fdch inicializa\u010dn\u00edch funkc\u00ed, m\u016f\u017ee objekt j\u00e1dra postr\u00e1dat p\u0159\u00edslu\u0161n\u00e9 informace o bezpe\u010dnosti. N\u011bkter\u00e9 moduly j\u00e1dra mohou tak\u00e9 postr\u00e1dat odpov\u00eddaj\u00edc\u00ed bezpe\u010dnostn\u00ed kontrolu sv\u00fdch operac\u00ed; jak\u00e9koliv existuj\u00edc\u00ed vol\u00e1n\u00ed funkc\u00ed j\u00e1dra nebo funkc\u00ed opr\u00e1vn\u011bn\u00ed tak\u00e9 spust\u00ed kontroly opr\u00e1vn\u011bn\u00ed SELinuxu, ale pro zaji\u0161t\u011bn\u00ed souladu s MAC politikami mohou b\u00fdt vy\u017eadov\u00e1ny podrobn\u011bj\u0161\u00ed nebo dal\u0161\u00ed kontroln\u00ed prvky.<br \/>\nLinux se zv\u00fd\u0161enou bezpe\u010dnost\u00ed by nem\u011bl zp\u016fsobovat probl\u00e9my s interakc\u00ed s b\u011b\u017en\u00fdmi syst\u00e9my Linux, pokud jsou v\u0161echny pot\u0159ebn\u00e9 operace povoleny konfigurac\u00ed bezpe\u010dnostn\u00ed politiky.<\/li>\n<\/ul>\n<\/li>\n<li>Jak\u00e9 jsou c\u00edle vzorov\u00e9 konfigurace bezpe\u010dnostn\u00ed politiky?<br \/>\nNa vysok\u00e9 \u00farovni je c\u00edlem demonstrovat flexibilitu a zabezpe\u010den\u00ed vynucen\u00fdch prost\u0159edk\u016f \u0159\u00edzen\u00ed p\u0159\u00edstupu a poskytnout jednoduch\u00fd funguj\u00edc\u00ed syst\u00e9m s minim\u00e1ln\u00edmi zm\u011bnami v aplikac\u00edch. Na ni\u017e\u0161\u00ed \u00farovni m\u00e1 politika \u0159adu c\u00edl\u016f popsan\u00fdch v dokumentaci k t\u00e9to politice. Tyto c\u00edle zahrnuj\u00ed spr\u00e1vu nepovolen\u00e9ho p\u0159\u00edstupu k dat\u016fm, ochranu integrity j\u00e1dra, syst\u00e9mov\u00e9ho software, informac\u00ed o konfiguraci syst\u00e9mu a syst\u00e9mov\u00fdch protokol\u016f, omezen\u00ed potenci\u00e1ln\u00edch \u0161kod, kter\u00e9 mohou b\u00fdt zp\u016fsobeny vyu\u017eit\u00edm zranitelnosti v procesu vy\u017eaduj\u00edc\u00edm privilegium, ochranu privilegovan\u00fdch proces\u016f p\u0159ed vykon\u00e1v\u00e1n\u00edm \u0161kodliv\u00e9ho k\u00f3du, ochranu role administr\u00e1tora a dom\u00e9ny p\u0159ed vstupem bez u\u017eivatelsk\u00e9 autentizace, zamezen\u00ed z\u00e1sah\u016fm b\u011b\u017en\u00fdch u\u017eivatelsk\u00fdch proces\u016f do syst\u00e9mov\u00fdch proces\u016f nebo proces\u016f administr\u00e1tora a ochranu u\u017eivatel\u016f a administr\u00e1tor\u016f p\u0159ed zranitelnostmi ve sv\u00e9m prohl\u00ed\u017ee\u010di pomoc\u00ed \u0161kodliv\u00e9ho mobiln\u00edho k\u00f3du.<\/li>\n<li>Pro\u010d byla Linux vybr\u00e1na jako z\u00e1kladn\u00ed platforma?<br \/>\nLinux byl vybr\u00e1n jako platforma pro po\u010d\u00e1te\u010dn\u00ed referen\u010dn\u00ed implementaci t\u00e9to pr\u00e1ce kv\u016fli sv\u00e9mu rostouc\u00edmu \u00fasp\u011bchu a otev\u0159en\u00e9mu v\u00fdvojov\u00e9mu prost\u0159ed\u00ed. Linux poskytuje vynikaj\u00edc\u00ed p\u0159\u00edle\u017eitost demonstrovat, \u017ee tato funkcionalita m\u016f\u017ee b\u00fdt \u00fasp\u011b\u0161n\u00e1 v hlavn\u00edm opera\u010dn\u00edm syst\u00e9mu a z\u00e1rove\u0148 p\u0159isp\u011bt k zabezpe\u010den\u00ed \u0161iroce pou\u017e\u00edvan\u00e9ho syst\u00e9mu. Platforma Linux tak\u00e9 poskytuje vynikaj\u00edc\u00ed p\u0159\u00edle\u017eitost pro tuto pr\u00e1ci z\u00edskat co nej\u0161ir\u0161\u00ed pohled a mo\u017en\u00e1 poslou\u017e\u00ed jako z\u00e1klad pro dal\u0161\u00ed bezpe\u010dnostn\u00ed v\u00fdzkum dal\u0161\u00edmi nad\u0161enci.<\/li>\n<li>Pro\u010d jste tuto pr\u00e1ci provedli?<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\/what-we-do\/research\/ia-research\/\">N\u00e1rodn\u00ed v\u00fdzkumn\u00e1 laborato\u0159 pro zabezpe\u010den\u00ed informa\u010dn\u00edch technologi\u00ed <\/a><\/noindex>Agentura n\u00e1rodn\u00ed bezpe\u010dnosti odpov\u00edd\u00e1 za v\u00fdzkum a pokro\u010dil\u00fd v\u00fdvoj technologi\u00ed pot\u0159ebn\u00fdch pro to, aby NSA mohla poskytovat \u0159e\u0161en\u00ed, produkty a slu\u017eby pro zabezpe\u010den\u00ed informa\u010dn\u00ed bezpe\u010dnosti pro informa\u010dn\u00ed infrastruktury, kter\u00e9 jsou kriticky d\u016fle\u017eit\u00e9 pro z\u00e1jmy n\u00e1rodn\u00ed bezpe\u010dnosti USA.<br \/>\nVytvo\u0159en\u00ed \u017eivotaschopn\u00e9ho bezpe\u010dn\u00e9ho opera\u010dn\u00edho syst\u00e9mu z\u016fst\u00e1v\u00e1 kl\u00ed\u010dov\u00fdm v\u00fdzkumn\u00fdm \u00fakolem. Na\u0161\u00edm c\u00edlem je vyvinout efektivn\u00ed architekturu, kter\u00e1 poskytuje nezbytnou podporu bezpe\u010dnosti, vykon\u00e1v\u00e1 programy v z\u00e1sad\u011b transparentn\u011b pro u\u017eivatele a je atraktivn\u00ed pro poskytovatele. Domn\u00edv\u00e1me se, \u017ee d\u016fle\u017eit\u00fdm krokem k dosa\u017een\u00ed tohoto c\u00edle je uk\u00e1zat, jak mohou b\u00fdt mechanismy \u0159\u00edzen\u00ed povinn\u00e9ho p\u0159\u00edstupu \u00fasp\u011b\u0161n\u011b integrov\u00e1ny do j\u00e1dra opera\u010dn\u00edho syst\u00e9mu.<\/li>\n<li>Jak to souvis\u00ed s p\u0159edchoz\u00edmi v\u00fdzkumy opera\u010dn\u00edch syst\u00e9m\u016f NSA?<br \/>\nV\u00fdzkumn\u00edci z N\u00e1rodn\u00ed laborato\u0159e pro zaji\u0161t\u011bn\u00ed d\u016fv\u011bryhodnosti informac\u00ed NSA ve spolupr\u00e1ci se Secure Computing Corporation (SCC) vyvinuli v\u00fdkonnou a flexibiln\u00ed architekturu povinn\u00e9 kontroly p\u0159\u00edstupu zalo\u017eenou na Type Enforcement, mechanismu, kter\u00fd byl poprv\u00e9 vyvinut pro syst\u00e9m LOCK. NSA a SCC vyvinuli dva prototypy architektury zalo\u017een\u00e9 na Mach: DTMach a DTOS (<noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.utah.edu\/flux\/dtos\/\">http:\/\/www.cs.utah.edu\/flux\/dtos\/<\/a><\/noindex>). NSA a SCC pot\u00e9 spolupracovali s v\u00fdzkumnou skupinou Flux z Univerzity v Utahu, aby p\u0159evedli architekturu do v\u00fdzkumn\u00e9ho opera\u010dn\u00edho syst\u00e9mu Fluke. B\u011bhem tohoto p\u0159evodu byla architektura vylep\u0161ena tak, aby poskytovala lep\u0161\u00ed podporu dynamick\u00fdm bezpe\u010dnostn\u00edm politik\u00e1m. Tato vylep\u0161en\u00e1 architektura byla nazv\u00e1na Flask (<noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.utah.edu\/flux\/flask\/\">http:\/\/www.cs.utah.edu\/flux\/flask\/<\/a><\/noindex>). NSA nyn\u00ed integrovalo architekturu Flask do opera\u010dn\u00edho syst\u00e9mu Linux, aby tuto technologii p\u0159edalo \u0161ir\u0161\u00ed komunit\u011b v\u00fdvoj\u00e1\u0159\u016f a u\u017eivatel\u016f.<\/li>\n<li>Je Linux s vylep\u0161enou bezpe\u010dnost\u00ed spolehliv\u00fdm opera\u010dn\u00edm syst\u00e9mem?<br \/>\nFr\u00e1ze \u201eD\u016fv\u011bryhodn\u00fd opera\u010dn\u00ed syst\u00e9m\u201c se obvykle vztahuje na opera\u010dn\u00ed syst\u00e9m, kter\u00fd poskytuje dostate\u010dnou podporu v\u00edce\u00farov\u0148ov\u00e9 ochrany a validace spr\u00e1vnosti, aby vyhov\u011bl ur\u010dit\u00fdm po\u017eadavk\u016fm vl\u00e1dy. Linux s vylep\u0161enou bezpe\u010dnost\u00ed zahrnuje u\u017eite\u010dn\u00e9 my\u0161lenky z t\u011bchto syst\u00e9m\u016f, ale zam\u011b\u0159uje se na vynucov\u00e1n\u00ed \u0159\u00edzen\u00ed p\u0159\u00edstupu. P\u016fvodn\u00edm c\u00edlem v\u00fdvoje Linuxu s vylep\u0161enou bezpe\u010dnost\u00ed bylo vytvo\u0159en\u00ed u\u017eite\u010dn\u00e9 funk\u010dnosti, kter\u00e1 poskytuje v\u00fdznamn\u00e9 v\u00fdhody ochrany v \u0161irok\u00e9 \u0161k\u00e1le re\u00e1ln\u00fdch prost\u0159ed\u00ed pro demonstraci t\u00e9to technologie. SELinux s\u00e1m o sob\u011b nen\u00ed d\u016fv\u011bryhodn\u00fdm opera\u010dn\u00edm syst\u00e9mem, ale poskytuje kriticky d\u016fle\u017eitou ochrannou funkci \u2014 vynucen\u00e9 \u0159\u00edzen\u00ed p\u0159\u00edstupu \u2014 nezbytnou pro d\u016fv\u011bryhodn\u00fd opera\u010dn\u00ed syst\u00e9m. SELinux byl integrov\u00e1n do distribuc\u00ed Linuxu, kter\u00e9 byly hodnoceny podle Labeled Security Protection Profile. Informace o certifikovan\u00fdch a auditovan\u00fdch produktech lze nal\u00e9zt na adrese <noindex><a rel=\"nofollow\" href=\"http:\/\/niap-ccevs.org\/\">http:\/\/niap-ccevs.org\/<\/a><\/noindex>.<\/li>\n<li>Je to skute\u010dn\u011b zabezpe\u010den\u00e9?<br \/>\nPojem zabezpe\u010den\u00e9ho syst\u00e9mu zahrnuje \u0159adu atribut\u016f (nap\u0159\u00edklad fyzickou bezpe\u010dnost, bezpe\u010dnost person\u00e1lu atd.) a Linux s vylep\u0161enou bezpe\u010dnost\u00ed se zam\u011b\u0159uje pouze na velmi \u00fazkou sadu t\u011bchto atribut\u016f (tj. prvky vynucen\u00e9ho p\u0159\u00edstupu v opera\u010dn\u00edm syst\u00e9mu). Jin\u00fdmi slovy, \u201ezabezpe\u010den\u00fd syst\u00e9m\u201c znamen\u00e1 dostate\u010dn\u011b zabezpe\u010den\u00fd, aby chr\u00e1nil ur\u010dit\u00e9 informace v re\u00e1ln\u00e9m sv\u011bt\u011b p\u0159ed skute\u010dn\u00fdm protivn\u00edkem, p\u0159ed kter\u00fdm varuje vlastn\u00edk a\/nebo u\u017eivatel informac\u00ed. Linux s vylep\u0161enou bezpe\u010dnost\u00ed je ur\u010den pouze k demonstraci povinn\u00fdch kontrol v modern\u00edm opera\u010dn\u00edm syst\u00e9mu, jako je Linux, a proto s\u00e1m o sob\u011b pravd\u011bpodobn\u011b nespl\u0148uje \u017e\u00e1dnou zaj\u00edmavou definici zabezpe\u010den\u00e9ho syst\u00e9mu. V\u011b\u0159\u00edme, \u017ee technologie demonstrovan\u00e1 v Linuxu s vylep\u0161enou bezpe\u010dnost\u00ed bude u\u017eite\u010dn\u00e1 pro lidi, kte\u0159\u00ed vytv\u00e1\u0159ej\u00ed zabezpe\u010den\u00e9 syst\u00e9my.<\/li>\n<li>Co jste ud\u011blali pro zv\u00fd\u0161en\u00ed z\u00e1ruk?<br \/>\nC\u00edlem tohoto projektu bylo p\u0159idat prvky vynucen\u00e9ho p\u0159\u00edstupu s minim\u00e1ln\u00edmi zm\u011bnami v Linuxu. Tento posledn\u00ed c\u00edl zna\u010dn\u011b omezuje mo\u017enosti zaji\u0161t\u011bn\u00ed, a proto pr\u00e1ce zam\u011b\u0159en\u00e1 na zvy\u0161ov\u00e1n\u00ed zaji\u0161t\u011bn\u00ed Linuxu nebyla provedena. Na druhou stranu, vylep\u0161en\u00ed jsou zalo\u017eena na p\u0159edchoz\u00ed pr\u00e1ci na v\u00fdvoji architektury bezpe\u010dnosti s vysokou m\u00edrou spolehlivosti a v\u011bt\u0161ina t\u011bchto princip\u016f n\u00e1vrhu byla p\u0159enesena do Linuxu s vylep\u0161enou bezpe\u010dnost\u00ed.<\/li>\n<li>Bude CCEVS hodnotit Linux s vylep\u0161enou bezpe\u010dnost\u00ed?<br \/>\nLinux s vylep\u0161enou bezpe\u010dnost\u00ed s\u00e1m o sob\u011b nen\u00ed navr\u017een k \u0159e\u0161en\u00ed komplexn\u00edho souboru bezpe\u010dnostn\u00edch probl\u00e9m\u016f, jak\u00e9 p\u0159edstavuje profil ochrany. I kdy\u017e by bylo mo\u017en\u00e9 hodnotit pouze jeho aktu\u00e1ln\u00ed funk\u010dnost, domn\u00edv\u00e1me se, \u017ee takov\u00e9 hodnocen\u00ed bude m\u00edt omezenou hodnotu. Nicm\u00e9n\u011b jsme spolupracovali s ostatn\u00edmi na zahrnut\u00ed t\u00e9to technologie do distribuc\u00ed Linuxu, kter\u00e9 byly hodnoceny, a distribuc\u00ed, kter\u00e9 jsou v procesu hodnocen\u00ed. Informace o ov\u011b\u0159en\u00fdch a testovan\u00fdch produktech najdete na <noindex><a rel=\"nofollow\" href=\"http:\/\/niap-ccevs.org\/\">http:\/\/niap-ccevs.org\/<\/a><\/noindex>.<\/li>\n<li>Pokou\u0161eli jste se opravit n\u011bjak\u00e9 zranitelnosti?<br \/>\nNe, b\u011bhem na\u0161\u00ed pr\u00e1ce jsme nehledali ani nena\u0161li \u017e\u00e1dn\u00e9 zranitelnosti. Pouze jsme provedli dostate\u010dn\u00e9 minimum pro p\u0159id\u00e1n\u00ed na\u0161ich nov\u00fdch mechanism\u016f.<\/li>\n<li>Je tento syst\u00e9m schv\u00e1len pro vl\u00e1dn\u00ed pou\u017eit\u00ed?<br \/>\nLinux s vylep\u0161enou bezpe\u010dnost\u00ed nem\u00e1 \u017e\u00e1dn\u00e9 zvl\u00e1\u0161tn\u00ed nebo dodate\u010dn\u00e9 schv\u00e1len\u00ed pro vl\u00e1dn\u00ed pou\u017eit\u00ed nad jakoukoli jinou verz\u00ed Linuxu.<\/li>\n<li>\u010c\u00edm se to li\u0161\u00ed od jin\u00fdch iniciativ?<br \/>\nLinux s vylep\u0161enou bezpe\u010dnost\u00ed m\u00e1 jasn\u011b definovanou architekturu pro flexibiln\u00ed vynucenou kontrolu p\u0159\u00edstupu, kter\u00e1 byla experiment\u00e1ln\u011b testov\u00e1na pomoc\u00ed n\u011bkolika prototypov\u00fdch syst\u00e9m\u016f (DTMach, DTOS, Flask). Podrobn\u00e9 studie byly provedeny s c\u00edlem dok\u00e1zat schopnost architektury podporovat \u0161irok\u00e9 spektrum bezpe\u010dnostn\u00edch politik a jsou k dispozici na <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.utah.edu\/flux\/dtos\/\">http:\/\/www.cs.utah.edu\/flux\/dtos\/<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cs.utah.edu\/flux\/flask\/\">http:\/\/www.cs.utah.edu\/flux\/flask\/<\/a><\/noindex>.<br \/>\nArchitektura poskytuje podrobn\u00e9 \u0159\u00edzen\u00ed mnoha abstrakc\u00ed j\u00e1dra a slu\u017eeb, kter\u00e9 nejsou ovl\u00e1d\u00e1ny jin\u00fdmi syst\u00e9my. N\u011bkter\u00e9 z charakteristick\u00fdch vlastnost\u00ed syst\u00e9mu Linux s roz\u0161\u00ed\u0159enou bezpe\u010dnost\u00ed zahrnuj\u00ed:<\/p>\n<ul>\n<li>\u010cist\u00e9 odd\u011blen\u00ed politiky od pr\u00e1vn\u00ed aplikace<\/li>\n<li>Jasn\u011b definovan\u00e1 rozhran\u00ed politik<\/li>\n<li>Nez\u00e1vislost na konkr\u00e9tn\u00edch politik\u00e1ch a jazyc\u00edch politik<\/li>\n<li>Nez\u00e1vislost na konkr\u00e9tn\u00edch form\u00e1tech a obsahu bezpe\u010dnostn\u00edch zna\u010dek<\/li>\n<li>Odd\u011blen\u00e9 zna\u010dky a ovl\u00e1dac\u00ed prvky pro objekty a slu\u017eby j\u00e1dra<\/li>\n<li>Caching rozhodnut\u00ed o p\u0159\u00edstupu pro efektivitu<\/li>\n<li>Podpora zm\u011bn politiky<\/li>\n<li>Kontrola nad inicializac\u00ed procesu, d\u011bd\u011bn\u00edm a prov\u00e1d\u011bn\u00edm programu<\/li>\n<li>Spr\u00e1va souborov\u00fdch syst\u00e9m\u016f, adres\u00e1\u0159\u016f, soubor\u016f a popis\u016f otev\u0159en\u00fdch soubor\u016f<\/li>\n<li>Spr\u00e1va socket\u016f, zpr\u00e1v a s\u00ed\u0165ov\u00fdch rozhran\u00ed<\/li>\n<li>Kontrola vyu\u017eit\u00ed 'Schopnost\u00ed'<\/li>\n<\/ul>\n<\/li>\n<li>Jak\u00e1 jsou licen\u010dn\u00ed omezen\u00ed tohoto syst\u00e9mu?<br \/>\nVe\u0161ker\u00fd zdrojov\u00fd k\u00f3d nalezen\u00fd na webu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\">https:\/\/www.nsa.gov<\/a><\/noindex>, se \u0161\u00ed\u0159\u00ed za stejn\u00fdch podm\u00ednek jako origin\u00e1ln\u00ed zdrojov\u00e9 k\u00f3dy. Nap\u0159\u00edklad opravy pro j\u00e1dro Linux a opravy pro mnoh\u00e9 st\u00e1vaj\u00edc\u00ed utilitky dostupn\u00e9 zde, jsou vyd\u00e1v\u00e1ny na z\u00e1klad\u011b <noindex><a rel=\"nofollow\" href=\"http:\/\/www.gnu.org\/licenses\/gpl.html\">GNU General Public License (GPL)<\/a><\/noindex>.<\/li>\n<li>Existuje kontrola v\u00fdvozu?<br \/>\nPro Linux s roz\u0161\u00ed\u0159enou bezpe\u010dnost\u00ed neexistuj\u00ed dal\u0161\u00ed prvky kontroly exportu ve srovn\u00e1n\u00ed s jakoukoliv jinou verz\u00ed Linuxu.<\/li>\n<li>Pl\u00e1nuje NSA pou\u017e\u00edvat ji uvnit\u0159 zem\u011b?<br \/>\nZ pochopiteln\u00fdch d\u016fvod\u016f NSA nekomentuje opera\u010dn\u00ed vyu\u017eit\u00ed.<\/li>\n<li>M\u011bn\u00ed prohl\u00e1\u0161en\u00ed o z\u00e1ruk\u00e1ch z 26. \u010dervence 2002 Secure Computing Corporation postoj NSA k tomu, \u017ee SELinux byl poskytnut v r\u00e1mci GNU General Public License?<br \/>\nPostoj NSA se nezm\u011bnil. NSA st\u00e1le v\u011b\u0159\u00ed, \u017ee ustanoven\u00ed a podm\u00ednky Standardn\u00ed ve\u0159ejn\u00e9 licence GNU \u0159\u00edd\u00ed pou\u017eit\u00ed, kop\u00edrov\u00e1n\u00ed, distribuci a modifikaci SELinux. Viz. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\/news-features\/press-room\/press-releases\/2001\/se-linux.shtml\">Tiskov\u00e1 zpr\u00e1va NSA ze 2. ledna 2001<\/a><\/noindex>.<\/li>\n<li>Podporuje NSA software s open source?<br \/>\nIniciativy NSA na zaji\u0161t\u011bn\u00ed bezpe\u010dnosti softwaru zahrnuj\u00ed jak propriet\u00e1rn\u00ed, tak open-source software, a \u00fasp\u011b\u0161n\u011b jsme vyu\u017eili jak propriet\u00e1rn\u00ed, tak otev\u0159en\u00e9 modely ve sv\u00e9 v\u00fdzkumn\u00e9 \u010dinnosti. \u010cinnost NSA v oblasti zaji\u0161t\u011bn\u00ed bezpe\u010dnosti softwaru je motivov\u00e1na jednou jednoduchou \u00favahou: maxim\u00e1ln\u011b efektivn\u011b vyu\u017e\u00edt na\u0161e zdroje k poskytov\u00e1n\u00ed nejlep\u0161\u00edch mo\u017en\u00fdch bezpe\u010dnostn\u00edch mo\u017enost\u00ed klient\u016fm NSA v nejv\u00edce pou\u017e\u00edvan\u00fdch produktech. C\u00edlem v\u00fdzkumn\u00e9ho programu NSA je vyvinout technologick\u00e1 vylep\u0161en\u00ed, kter\u00e1 m\u016f\u017eeme sd\u00edlet s komunitou v\u00fdvoj\u00e1\u0159\u016f softwaru prost\u0159ednictv\u00edm r\u016fzn\u00fdch p\u0159enosov\u00fdch mechanism\u016f. NSA nepodporuje ani nepropaguje konkr\u00e9tn\u00ed softwarov\u00fd produkt nebo obchodn\u00ed model. Sp\u00ed\u0161e, NSA p\u0159isp\u00edv\u00e1 k zaji\u0161t\u011bn\u00ed bezpe\u010dnosti.<\/li>\n<li>Podporuje NSA Linux?<br \/>\nJak bylo v\u00fd\u0161e zm\u00edn\u011bno, NSA nepodporuje ani nepropaguje konkr\u00e9tn\u00ed softwarov\u00fd produkt nebo platformu; NSA pouze p\u0159isp\u00edv\u00e1 k zaji\u0161t\u011bn\u00ed bezpe\u010dnosti. Architektura Flask, demonstrovan\u00e1 v referen\u010dn\u00ed implementaci SELinux, byla p\u0159enesena na n\u011bkolik dal\u0161\u00edch opera\u010dn\u00edch syst\u00e9m\u016f, v\u010detn\u011b Solaris, FreeBSD a Darwin, a byla portov\u00e1na na hypervisor Xen a aplikuje se na aplikace jako X Window System, GConf, D-BUS a PostgreSQL. Koncepty architektury Flask jsou \u0161iroce aplikovateln\u00e9 na \u0161irokou \u0161k\u00e1lu syst\u00e9m\u016f a prost\u0159ed\u00ed.<\/li>\n<\/ol>\n<p><\/p>\n<h2 id=\"sotrudnichestvo\">Spolupr\u00e1ce<\/h2>\n<p><\/p>\n<ol>\n<li>Jak pl\u00e1nujeme interagovat se komunitou Linux?<br \/>\nM\u00e1me <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\/what-we-do\/research\/selinux\/\">sada webov\u00fdch str\u00e1nek na NSA.gov<\/a><\/noindex>, kter\u00e9 budou slou\u017eit jako n\u00e1\u0161 hlavn\u00ed zp\u016fsob publikov\u00e1n\u00ed informac\u00ed o Linuxu s vylep\u0161enou bezpe\u010dnost\u00ed. Pokud m\u00e1te z\u00e1jem o Linux s vylep\u0161enou bezpe\u010dnost\u00ed, doporu\u010dujeme se p\u0159ipojit k e-mailov\u00e9mu seznamu v\u00fdvoj\u00e1\u0159\u016f, prozkoumat zdrojov\u00fd k\u00f3d a poskytnout svou zp\u011btnou vazbu (nebo k\u00f3d). Chcete-li se p\u0159ipojit k e-mailov\u00e9mu seznamu v\u00fdvoj\u00e1\u0159\u016f, nav\u0161tivte pros\u00edm. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\/what-we-do\/research\/selinux\/mailing-list.shtml\">Str\u00e1nku seznamu v\u00fdvoj\u00e1\u0159\u016f SELinux<\/a><\/noindex>. <\/li>\n<li>Kdo m\u016f\u017ee pomoci?<br \/>\nSELinux nyn\u00ed podporuj\u00ed a vyv\u00edjej\u00ed v\u00fdvoj\u00e1\u0159i softwaru pro Linux z otev\u0159en\u00e9ho zdroje.<\/li>\n<li>Financuje NSA n\u011bjakou dal\u0161\u00ed pr\u00e1ci?<br \/>\nV sou\u010dasnosti NSA nezva\u017euje n\u00e1vrhy na dal\u0161\u00ed pr\u00e1ci.<\/li>\n<li>Jak\u00fd typ podpory je dostupn\u00fd?<br \/>\nPl\u00e1nujeme \u0159e\u0161it dotazy prost\u0159ednictv\u00edm mailing listu selinux@tycho.nsa.gov, ale nebudeme schopni odpov\u011bd\u011bt na v\u0161echny ot\u00e1zky t\u00fdkaj\u00edc\u00ed se konkr\u00e9tn\u00edho webu.<\/li>\n<li>Kdo pomohl? Co ud\u011blali?<br \/>\nPrototyp Linuxu se zlep\u0161enou bezpe\u010dnost\u00ed byl vyvinut NSA ve spolupr\u00e1ci s v\u00fdzkumn\u00fdmi partnery z NAI Labs, Secure Computing Corporation (SCC) a MITER Corporation. Po prvn\u00edm ve\u0159ejn\u00e9m vyd\u00e1n\u00ed n\u00e1sledovalo mnoho dal\u0161\u00edch materi\u00e1l\u016f. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nsa.gov\/what-we-do\/research\/selinux\/contributors.shtml\">Pod\u00edvejte se na seznam \u00fa\u010dastn\u00edk\u016f<\/a><\/noindex>.<\/li>\n<li>Jak se mohu dozv\u011bd\u011bt v\u00edce?<br \/>\nDoporu\u010dujeme v\u00e1m nav\u0161t\u00edvit na\u0161e webov\u00e9 str\u00e1nky, p\u0159e\u010d\u00edst si dokumentaci a p\u0159edchoz\u00ed v\u00fdzkumn\u00e9 pr\u00e1ce a z\u00fa\u010dastnit se na\u0161eho mailing listu selinux@vger.kernel.org.<\/li>\n<\/ol>\n<p><\/p>\n<p>Pova\u017eujete p\u0159eklad za u\u017eite\u010dn\u00fd? Napi\u0161te n\u00e1m sv\u00e9 koment\u00e1\u0159e!<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/459598\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u0442\u0443\u0434\u0435\u043d\u0442\u043e\u0432 \u043a\u0443\u0440\u0441\u0430 &#171;\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Linux&#187; \u043c\u044b \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e FAQ \u043f\u0440\u043e\u0435\u043a\u0442\u0430 SELinux. \u041d\u0430\u043c \u043a\u0430\u0436\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u0442\u0443\u0434\u0435\u043d\u0442\u0430\u043c, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0438\u043c \u0441 \u0432\u0430\u043c\u0438. \u041c\u044b \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u043e\u0442\u0432\u0435\u0442\u0438\u0442\u044c \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u0437\u0430\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0435 SELinux. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0434\u0432\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438. \u0412\u0441\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27020,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36129","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u0442\u0443\u0434\u0435\u043d\u0442\u043e\u0432 \u043a\u0443\u0440\u0441\u0430 &quot;\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Linux&quot; \u043c\u044b \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e FAQ \u043f\u0440\u043e\u0435\u043a\u0442\u0430 SELinux.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chasto-zadavaemye-voprosy-po-selinux-faq\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0430\u0441\u0442\u043e \u0437\u0430\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043f\u043e SELinux (FAQ) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u0442\u0443\u0434\u0435\u043d\u0442\u043e\u0432 \u043a\u0443\u0440\u0441\u0430 &quot;\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Linux&quot; \u043c\u044b \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e FAQ \u043f\u0440\u043e\u0435\u043a\u0442\u0430 SELinux.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chasto-zadavaemye-voprosy-po-selinux-faq\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:09:46+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:09:46+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u010casto kladen\u00e9 dotazy k SELinuxu (FAQ) | ProHoster","description":"Ahoj v\u0161ichni!Speci\u00e1ln\u011b pro studenty kurzu \"Bezpe\u010dnost Linuxu\" jsme p\u0159ipravili p\u0159eklad ofici\u00e1ln\u00edho FAQ projektu SELinux.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chasto-zadavaemye-voprosy-po-selinux-faq","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0430\u0441\u0442\u043e \u0437\u0430\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043f\u043e SELinux (FAQ) | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u0442\u0443\u0434\u0435\u043d\u0442\u043e\u0432 \u043a\u0443\u0440\u0441\u0430 &quot;\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Linux&quot; \u043c\u044b \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e FAQ \u043f\u0440\u043e\u0435\u043a\u0442\u0430 SELinux.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chasto-zadavaemye-voprosy-po-selinux-faq","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:09:46+00:00","article:modified_time":"2019-10-31T19:09:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36129","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:08:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:50:23","updated":"2026-01-22 02:08:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=36129"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36129\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27020"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=36129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=36129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=36129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}