{"id":36280,"date":"2019-10-31T22:10:39","date_gmt":"2019-10-31T19:10:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rukovodstvo-dlya-nachinayushhih-po-selinux\/"},"modified":"2019-10-31T22:10:39","modified_gmt":"2019-10-31T19:10:39","slug":"rukovodstvo-dlya-nachinayushhih-po-selinux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/rukovodstvo-dlya-nachinayushhih-po-selinux","title":{"rendered":"Udh\u00ebzuesi p\u00ebr t\u00eb fillestar\u00ebt p\u00ebr SELinux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Udh\u00ebzuesi<\/p>\n

<\/p>\n

P\u00ebrkthimi i artikullit \u00ebsht\u00eb p\u00ebrgatitur p\u00ebr student\u00ebt e kursit \u00abSiguria e Linux\u00bb<\/a><\/noindex><\/em><\/p>\n

SELinux ose Security Enhanced Linux \u00ebsht\u00eb nj\u00eb mekaniz\u00ebm i avancuar i kontrollit t\u00eb aksesit, i zhvilluar nga Agjencia e Siguris\u00eb Komb\u00ebtare t\u00eb SHBA (NSA) p\u00ebr t\u00eb parandaluar dep\u00ebrtimet e keqdashura. Ai zbatohet nj\u00eb model t\u00eb detyruar (ose mandatar) t\u00eb kontrollit t\u00eb aksesit (angl. Mandatory Access Control, MAC) mbi modelin ekzistues diskrecional (ose selektiv) t\u00eb kontrollit t\u00eb aksesit (angl. Discretionary Access Control, DAC), q\u00eb do t\u00eb thot\u00eb lejet p\u00ebr lexim, shkruajtes\u00eb dhe ekzekutim.<\/a><\/noindex><\/p>\n

<\/p>\n

SELinux ka tre mund\u00ebsi operimi:<\/p>\n

<\/p>\n

    \n
  1. Enforcing<\/strong> \u2014 ndalon aksesin mbi baz\u00ebn e rregullave t\u00eb politik\u00ebs.<\/li>\n
  2. Permissive<\/strong> \u2014 regjistron veprimet q\u00eb shkelin politik\u00ebn, t\u00eb cilat n\u00eb m\u00ebnyr\u00ebn enforcing do ishin ndaluar.<\/li>\n
  3. \u00c7aktivizuar<\/strong> \u2014 \u00e7aktivizimi i plot\u00eb i SELinux.<\/li>\n<\/ol>\n

    <\/p>\n

    P\u00ebr default, cil\u00ebsimet ndodhen n\u00eb \/etc\/selinux\/config<\/code><\/p>\n

    <\/p>\n

    Modifikimi i mund\u00ebsive t\u00eb operimit t\u00eb SELinux<\/h1>\n

    <\/p>\n

    P\u00ebr t\u00eb par\u00eb mund\u00ebsin\u00eb aktuale, ekzekutoni <\/p>\n

    <\/p>\n

    $ getenforce<\/code><\/pre>\n
    <\/p>\n
    P\u00ebr t\u00eb ndryshuar mund\u00ebsin\u00eb n\u00eb permissive, ekzekutoni komand\u00ebn n\u00eb vijim <\/p>\n
    <\/p>\n
    $ setenforce 0<\/code><\/pre>\n
    <\/p>\n
    ose, p\u00ebr t\u00eb ndryshuar mund\u00ebsin\u00eb nga permissive<\/strong> n\u00eb enforcing<\/strong>, ekzekutoni <\/p>\n
    <\/p>\n
    $ setenforce 1<\/code><\/pre>\n
    <\/p>\n
    N\u00ebse ju nevojitet t\u00eb \u00e7aktivizoni plot\u00ebsisht SELinux, at\u00ebher\u00eb mund ta b\u00ebni k\u00ebt\u00eb vet\u00ebm p\u00ebrmes sked\u00ebs s\u00eb konfigurimit <\/p>\n
    <\/p>\n
    $ vi \/etc\/selinux\/config<\/code><\/pre>\n
    <\/p>\n
    P\u00ebr ta \u00e7aktivizuar, ndryshoni parametrin SELINUX n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb:<\/p>\n
    <\/p>\n
    SELINUX=disabled<\/code><\/pre>\n
    <\/p>\n
    Cil\u00ebsimi i SELinux<\/h1>\n
    <\/p>\n
    \u00c7do sked\u00eb dhe proces sh\u00ebnohet me kontekstin SELinux, i cili p\u00ebrmban informacion shtes\u00eb si p\u00ebrdoruesi, roli, tipi, etj. N\u00ebse e aktivizoni p\u00ebr her\u00eb t\u00eb par\u00eb SELinux, duhet fillimisht t\u00eb konfiguroni kontekstin dhe etiketat. Procesi i vendosjes s\u00eb etiketave dhe konteksteve njihet si etiketimi. P\u00ebr t\u00eb filluar etiketimin, n\u00eb sked\u00ebn e konfigurimit ndryshoni mund\u00ebsin\u00eb n\u00eb permissive<\/strong>.<\/p>\n
    <\/p>\n
    $ vi \/etc\/selinux\/config\nSELINUX=permissive<\/code><\/pre>\n
    <\/p>\n
    Pasi t\u00eb keni vendosur mund\u00ebsin\u00eb permissive<\/strong>, krijoni nj\u00eb sked\u00eb t\u00eb fsheht\u00eb t\u00eb zbraz\u00ebt me emrin .autorelabel<\/code><\/p>\n
    <\/p>\n
    $ touch \/.autorelabel<\/code><\/pre>\n
    <\/p>\n
    dhe ri-ngarkoni kompjuterin<\/p>\n
    <\/p>\n
    $ init 6<\/code><\/pre>\n
    <\/p>\n
    Sh\u00ebnim: ne p\u00ebrdorim mund\u00ebsin\u00eb permissive<\/strong> p\u00ebr etiketim, pasi p\u00ebrdorimi i mund\u00ebsis\u00eb enforcing<\/strong> mund t\u00eb \u00e7oj\u00eb n\u00eb r\u00ebnien e sistemit gjat\u00eb ri-ngarkimit.<\/p>\n
    <\/p>\n
    Mos u shqet\u00ebsoni, n\u00ebse ngarkimi ngec n\u00eb ndonj\u00eb sked\u00eb, etiketimi merr disa koh\u00eb. Pasi t\u00eb p\u00ebrfundoj\u00eb etiketimi dhe ngarkimi i sistemit tuaj, mund t\u00eb shkoni te skeda e konfigurimit dhe t\u00eb vendosni mund\u00ebsin\u00eb enforcing<\/strong>, si dhe t\u00eb ekzekutoni:<\/p>\n
    <\/p>\n
    $ setenforce 1<\/code><\/pre>\n
    <\/p>\n
    Tani keni aktivizuar me sukses SELinux n\u00eb kompjuterin tuaj. <\/p>\n
    <\/p>\n
    Monitorimi i log\u00ebve<\/h1>\n
    <\/p>\n
    Mund t\u00eb keni pasur ndonj\u00eb problem gjat\u00eb etiketimit ose gjat\u00eb funksionimit t\u00eb sistemit. P\u00ebr t\u00eb kontrolluar n\u00ebse SELinux juaj funksionon si\u00e7 duhet dhe nuk po bllokon qasje n\u00eb ndonj\u00eb port, aplikacion etj., nevojitet t\u00eb shikoni log\u00ebt. Logu i SELinux ndodhet n\u00eb \/var\/log\/audit\/audit.log<\/code>, por ju nuk keni nevoj\u00eb ta lexoni t\u00ebr\u00ebsisht p\u00ebr t\u00eb gjetur gabimet. Mund t\u00eb p\u00ebrdorni mjetin audit2why p\u00ebr t\u00eb gjetur gabimet. Ekzekutoni komand\u00ebn e m\u00ebposhtme:<\/p>\n
    <\/p>\n
    $ audit2why < \/var\/log\/audit\/audit.log<\/code><\/pre>\n
    <\/p>\n
    Si rezultat, do t\u00eb merrni nj\u00eb list\u00eb gabimesh. N\u00ebse nuk ka gabimesh n\u00eb log, asnj\u00eb mesazh nuk do t\u00eb shfaqet.<\/p>\n
    <\/p>\n
    Konfigurimi i politik\u00ebs SELinux<\/h1>\n
    <\/p>\n
    Politika SELinux \u00ebsht\u00eb nj\u00eb grumbull rregullash q\u00eb ndjek mekanizmi i siguris\u00eb SELinux. Politika p\u00ebrcakton nj\u00eb set rregullash p\u00ebr nj\u00eb ambient t\u00eb caktuar. Tani do t\u00eb shqyrtojm\u00eb si t\u00eb konfigurojm\u00eb politikat p\u00ebr t\u00eb lejuar qasje n\u00eb sh\u00ebrbime t\u00eb ndaluara.<\/p>\n
    <\/p>\n
    1. Vlera logjike (\u00e7elsa)<\/h4>\n
    <\/p>\n
    \u00c7el\u00ebsat (booleans) lejojn\u00eb t\u00eb ndryshoni pjes\u00eb t\u00eb politik\u00ebs gjat\u00eb pun\u00ebs, pa nevoj\u00ebn p\u00ebr t\u00eb krijuar politika t\u00eb reja. Ato lejojn\u00eb t\u00eb b\u00ebni ndryshime pa rindizjen ose rikompilimin e politikave SELinux.<\/p>\n
    <\/p>\n
    Shembulli<\/strong>
    \nSupozoni se duam t\u00eb ofrojm\u00eb qasje n\u00eb katalogun e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit p\u00ebr FTP n\u00eb lexim dhe shk write, dhe ne tashm\u00eb e kemi ndar\u00eb at\u00eb, por kur mundohemi t\u00eb qasje, nuk shohim asgj\u00eb. Kjo ndodh sepse politika SELinux i ndalon serverit FTP t\u00eb lexoj\u00eb dhe t\u00eb shkruaj\u00eb n\u00eb katalogun e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit. Na nevojitet t\u00eb ndryshojm\u00eb politik\u00ebn q\u00eb serveri FTP t\u00eb mund t\u00eb qaset n\u00eb katalog\u00ebt e sht\u00ebpis\u00eb. Le t\u00eb shohim n\u00ebse ka ndonj\u00eb \u00e7el\u00ebs p\u00ebr k\u00ebt\u00eb duke ekzekutuar<\/p>\n
    <\/p>\n
    $ semanage boolean -l<\/code><\/pre>\n
    <\/p>\n
    Kjo komand\u00eb do t\u00eb jap\u00eb nj\u00eb list\u00eb \u00e7el\u00ebsash t\u00eb disponuesh\u00ebm me gjendjen e tyre aktuale (e aktivizuar\/on ose e \u00e7aktivizuar\/off) dhe p\u00ebrshkrimin. Mund t\u00eb p\u00ebrcaktoni k\u00ebrkimin tuaj duke shtuar grep p\u00ebr t\u00eb gjetur rezultate q\u00eb i p\u00ebrkasin vet\u00ebm ftp:<\/p>\n
    <\/p>\n
    $ semanage boolean -l | grep ftp<\/code><\/pre>\n
    <\/p>\n
    dhe do t\u00eb gjeni k\u00ebt\u00eb<\/p>\n
    <\/p>\n
    ftp_home_dir -> off       Lejo ftp t\u00eb lexoj\u00eb & shkruaj\u00eb skedarin n\u00eb katalogun e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit<\/code><\/pre>\n
    <\/p>\n
    Ky \u00e7el\u00ebs \u00ebsht\u00eb i \u00e7aktivizuar, k\u00ebshtu q\u00eb do ta aktivizojm\u00eb at\u00eb duke p\u00ebrdorur setsebool $ setsebool ftp_home_dir on<\/code><\/p>\n
    <\/p>\n
    Tani demonin ton\u00eb ftp do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb qaset n\u00eb katalogun e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit.
    \nSh\u00ebnim: mund t\u00eb merrni gjithashtu nj\u00eb list\u00eb t\u00eb \u00e7el\u00ebsave t\u00eb disponuesh\u00ebm pa p\u00ebrshkrim duke ekzekutuar getsebool -a<\/code><\/p>\n
    <\/p>\n
    2. Etiketat dhe konteksti<\/h4>\n
    <\/p>\n
    Ky \u00ebsht\u00eb m\u00ebnyra m\u00eb e zakonshme p\u00ebr t\u00eb p\u00ebrmbushur politikat SELinux. \u00c7do skedar, dosje, proces dhe port etiketohen me kontekstin SELinux:<\/p>\n
    <\/p>\n