{"id":36280,"date":"2019-10-31T22:10:39","date_gmt":"2019-10-31T19:10:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rukovodstvo-dlya-nachinayushhih-po-selinux\/"},"modified":"2019-10-31T22:10:39","modified_gmt":"2019-10-31T19:10:39","slug":"rukovodstvo-dlya-nachinayushhih-po-selinux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/rukovodstvo-dlya-nachinayushhih-po-selinux","title":{"rendered":"Udhezues p\u00ebr fillestar\u00ebt mbi SELinux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Udhezues<\/p>\n

<\/p>\n

P\u00ebrkthimi i artikullit \u00ebsht\u00eb p\u00ebrgatitur p\u00ebr student\u00ebt e kursit \u00abSiguria n\u00eb Linux\u00bb<\/a><\/noindex><\/em><\/p>\n

SELinux ose Security Enhanced Linux \u00ebsht\u00eb nj\u00eb mekaniz\u00ebm i avancuar p\u00ebr menaxhimin e qasjes, i zhvilluar nga Agjencia Komb\u00ebtare e Siguris\u00eb e SHBA (NSA) p\u00ebr t\u00eb parandaluar p\u00ebrpjekjet e d\u00ebmshme t\u00eb dep\u00ebrgimit. Ai zbaton nj\u00eb model t\u00eb detyruar (ose mandator) t\u00eb menaxhimit t\u00eb qasjes (Mandatory Access Control, MAC) mbi nj\u00eb model ekzistues t\u00eb p\u00ebrzgjedhur (Discretionary Access Control, DAC), dometh\u00ebn\u00eb lejet p\u00ebr lexim, shkruar dhe ekzekutim.<\/a><\/noindex><\/p>\n

<\/p>\n

SELinux ka tre m\u00ebnyra:<\/p>\n

<\/p>\n

    \n
  1. Enforcing<\/strong> \u2014 ndalon qasjen n\u00eb baz\u00eb t\u00eb rregullave t\u00eb politik\u00ebs.<\/li>\n
  2. Permissive<\/strong> \u2014 regjistron veprimet q\u00eb shkelin politik\u00ebn, t\u00eb cilat n\u00eb m\u00ebnyr\u00ebn enforcing do ishin t\u00eb ndaluara.<\/li>\n
  3. Disabled<\/strong> \u2014 \u00e7aktivizimi i plot\u00eb i SELinux.<\/li>\n<\/ol>\n

    <\/p>\n

    N\u00eb parazgjedhje, cil\u00ebsimet ndodhen n\u00eb \/etc\/selinux\/config<\/code><\/p>\n

    <\/p>\n

    Ndryshimi i m\u00ebnyrave t\u00eb SELinux<\/h1>\n

    <\/p>\n

    P\u00ebr t\u00eb m\u00ebsuar m\u00ebnyr\u00ebn aktuale, ekzekutoni <\/p>\n

    <\/p>\n

    $ getenforce<\/code><\/pre>\n
    <\/p>\n
    P\u00ebr t\u00eb ndryshuar m\u00ebnyr\u00ebn n\u00eb permissive, ekzekutoni komand\u00ebn e m\u00ebposhtme <\/p>\n
    <\/p>\n
    $ setenforce 0<\/code><\/pre>\n
    <\/p>\n
    ose, p\u00ebr t\u00eb ndryshuar m\u00ebnyr\u00ebn nga permissive<\/strong> n\u00eb n\u00eb<\/strong>enforcing <\/p>\n
    <\/p>\n
    , ekzekutoni<\/code><\/pre>\n
    <\/p>\n
    $ setenforce 1 <\/p>\n
    <\/p>\n
    N\u00ebse ju nevojitet t\u00eb \u00e7aktivizoni plot\u00ebsisht SELinux, kjo mund t\u00eb b\u00ebhet vet\u00ebm n\u00ebp\u00ebrmjet skedarit t\u00eb konfigurimit<\/code><\/pre>\n
    <\/p>\n
    $ vi \/etc\/selinux\/config<\/p>\n
    <\/p>\n
    SELINUX=disabled<\/code><\/pre>\n
    <\/p>\n
    P\u00ebr ta \u00e7aktivizuar, ndryshoni parametrin SELINUX si m\u00eb posht\u00eb:<\/h1>\n
    <\/p>\n
    Konfigurimi i SELinux permissive<\/strong>.<\/p>\n
    <\/p>\n
    $ vi \/etc\/selinux\/config\nSELINUX=permissive<\/code><\/pre>\n
    <\/p>\n
    Pas vendosjes s\u00eb modit permissive<\/strong>, krijojm\u00eb nj\u00eb skedar t\u00eb zbraz\u00ebt t\u00eb fsheht\u00eb me emrin .autorelabel<\/code><\/p>\n
    <\/p>\n
    $ touch \/.autorelabel<\/code><\/pre>\n
    <\/p>\n
    dhe rindezim kompjuterin<\/p>\n
    <\/p>\n
    $ init 6<\/code><\/pre>\n
    <\/p>\n
    Sh\u00ebnim: ne p\u00ebrdorim modin permissive<\/strong> p\u00ebr etiketimin, pasi p\u00ebrdorimi i modit n\u00eb<\/strong> mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtimin e sistemit gjat\u00eb rindezjes.<\/p>\n
    <\/p>\n
    Mos u shqet\u00ebsoni n\u00ebse ngarkimi ngec n\u00eb ndonj\u00eb skedar, etiketimi merr disa koh\u00eb. Pas p\u00ebrfundimit t\u00eb etiketimit dhe ngarkimit t\u00eb sistemit tuaj, mund t\u00eb shkoni te skedari i konfigurimit dhe t\u00eb vendosni modin n\u00eb<\/strong>, si\u00e7 duhet t\u00eb ekzekutoni:<\/p>\n
    <\/p>\n
    , ekzekutoni<\/code><\/pre>\n
    <\/p>\n
    Tani e keni aktivizuar me sukses SELinux n\u00eb kompjuterin tuaj. <\/p>\n
    <\/p>\n
    Monitoroni loget<\/h1>\n
    <\/p>\n
    Mund t\u00eb keni hasur disa gabime gjat\u00eb etiketimit ose n\u00eb funksionin e sistemit. P\u00ebr t\u00eb kontrolluar n\u00ebse SELinux-i juaj funksionon si\u00e7 duhet dhe nuk bllokon aksesin n\u00eb ndonj\u00eb port, aplikacion etj., duhet t\u00eb kontrolloni log-et. Log-u i SELinux-it ndodhet n\u00eb \/var\/log\/audit\/audit.log<\/code>, por nuk keni nevoj\u00eb ta lexoni t\u00ebr\u00ebsisht p\u00ebr t\u00eb gjetur gabimet. Mund t\u00eb p\u00ebrdorni utilitarin audit2why p\u00ebr t\u00eb gjetur gabimet. Ekzekutoni komand\u00ebn e m\u00ebposhtme:<\/p>\n
    <\/p>\n
    $ audit2why < \/var\/log\/audit\/audit.log<\/code><\/pre>\n
    <\/p>\n
    Si rezultat, do t\u00eb merrni nj\u00eb list\u00eb gabimesh. N\u00ebse nuk ka pasur gabime n\u00eb log, nuk do t\u00eb shfaqen mesazhe.<\/p>\n
    <\/p>\n
    Konfigurimi i politik\u00ebs SELinux<\/h1>\n
    <\/p>\n
    Politika SELinux \u00ebsht\u00eb nj\u00eb grup rregullash t\u00eb cilat udh\u00ebheqin mekanizmin e siguris\u00eb SELinux. Politika p\u00ebrcakton nj\u00eb set rregullash p\u00ebr nj\u00eb mjedis t\u00eb caktuar. Tani do t\u00eb studiojm\u00eb se si t\u00eb konfigurojm\u00eb politikat p\u00ebr t\u00eb lejuar aksesin n\u00eb sh\u00ebrbime t\u00eb ndaluara.<\/p>\n
    <\/p>\n
    1. Vlera logjike (nd\u00ebrrues)<\/h4>\n
    <\/p>\n
    Nd\u00ebrruesit (booleans) lejojn\u00eb ndryshimin e pjes\u00ebve t\u00eb politik\u00ebs gjat\u00eb funksionimit, pa pasur nevoj\u00eb t\u00eb krijoni politika t\u00eb reja. Ata lejojn\u00eb t\u00eb b\u00ebni ndryshime pa rinisjen ose rim\u00ebk\u00ebmbjen e politikave SELinux.<\/p>\n
    <\/p>\n
    Shembuj<\/strong>
    \nSupozoni se d\u00ebshirojm\u00eb t\u00eb ofrojm\u00eb qasje n\u00eb dosjen e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit p\u00ebrmes FTP p\u00ebr lexim dhe shkruanim, dhe tashm\u00eb e kemi ndar\u00eb at\u00eb, por kur p\u00ebrpiqemi t\u00eb qasemi, nuk shohim asgj\u00eb. Kjo ndodh sepse politika SELinux ndalon serverin FTP t\u00eb lexoj\u00eb dhe shkruaj\u00eb n\u00eb dosjen e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit. Na nevojitet t\u00eb ndryshojm\u00eb politik\u00ebn n\u00eb m\u00ebnyr\u00eb q\u00eb serveri FTP t\u00eb mund t\u00eb accedoj\u00eb n\u00eb dosjet e sht\u00ebpis\u00eb. Le t\u00eb shohim n\u00ebse ka ndonj\u00eb kalues p\u00ebr k\u00ebt\u00eb, duke e ekzekutuar<\/p>\n
    <\/p>\n
    $ semanage boolean -l<\/code><\/pre>\n
    <\/p>\n
    Kjo komand\u00eb do t\u00eb jap\u00eb nj\u00eb list\u00eb t\u00eb kaluesve t\u00eb disponuesh\u00ebm me gjendjen e tyre aktuale (aktive\/on ose inaktive\/off) dhe p\u00ebrshkrimin. Mund t\u00eb sqaroni k\u00ebrkimin tuaj duke shtuar grep, p\u00ebr t\u00eb gjetur rezultate q\u00eb i p\u00ebrkasin vet\u00ebm ftp:<\/p>\n
    <\/p>\n
    $ semanage boolean -l | grep ftp<\/code><\/pre>\n
    <\/p>\n
    dhe do t\u00eb gjeni t\u00eb volgende<\/p>\n
    <\/p>\n
    ftp_home_dir        -> off       Lejo ftp t\u00eb lexoj\u00eb & shkruaj\u00eb skedarin n\u00eb dosjen e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit<\/code><\/pre>\n
    <\/p>\n
    Ky kalues \u00ebsht\u00eb i \u00e7aktivizuar, k\u00ebshtu q\u00eb do ta aktivizojm\u00eb at\u00eb me setsebool $ setsebool ftp_home_dir on<\/code><\/p>\n
    <\/p>\n
    Tani, demonit ton\u00eb ftp do t'i lejohet t\u00eb ket\u00eb qasje n\u00eb dosjen e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit.
    \nSh\u00ebnim: gjithashtu mund t\u00eb merrni nj\u00eb list\u00eb t\u00eb kaluesve t\u00eb disponuesh\u00ebm pa p\u00ebrshkrim, duke ekzekutuar getsebool -a<\/code><\/p>\n
    <\/p>\n
    2. Etiketat dhe konteksti<\/h4>\n
    <\/p>\n
    Ky \u00ebsht\u00eb m\u00ebnyra m\u00eb e zakonshme p\u00ebr t\u00eb zbatuar politik\u00ebn SELinux. \u00c7do skedar, dosje, proces dhe port etiketohen me kontekstin SELinux:<\/p>\n
    <\/p>\n