ืืืื ืข ืคืื โโืื ืกืืืืช ืคืืจื ืืจืืืกื ืขืจืคืืื Linux ืื ืึธืคึผืขืจืืจื ืกืืกืืขื ืืืืฃ ืขืืืขืืขื, ืืึธืืื ืืขืืืืกืขืก ืืื ืกืขืจืืืขืจืก ืืื ืึท ืืึทื ืฅ ืืืื ืืืจืื ืคืื ืืืืขืจืืืื ืคึฟืึทืจ ืื ืงืขืจื ืขื, ืคึฟืึทืจืืื ืืขื ืข ืืึทืืื ืื ืืขื ืืื ืึทืคึผืืึทืงืืืฉืึทื ื. ืึธืืขืจ ืืืื ืฆื ืืขืจ ืงืขืจื ืขื ืืจืืืืขืงืืืจ Linux, ืืขืืึธืื ืงืขื ื ืืืจ ื ืืฉื ืืขืคึฟืื ืขื ืงืืื ืงืืืึทืืจืึทื ืืื ืืื ืืืึธืก ืืื ืคึฟืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืืืืขืจืืืื ืืื ืึทืืึท. ืืืื ืืึทืืึทืื ืืื ืื ืืืืขืจืืืื ืกืืืกืืกืืขื? Linux ืืื ืืืึธืก ืืึทืฉืืืื ืขืก ืคึฟืื?
ืคึผืจืขืืืกืืึธืจื Linux ืืืืขืจืืืื ืืึธืืืื ืืื SELinux
ืคึฟืึทืจืืขืกืขืจืืข ืืืืขืจืืืื Linux ืืื ืึท ืกืืื ืคืื ืึผืืืื ืืื ืฆืืืจืื ืืขืืึทื ืืืืขื ืืึทืืืจื ืืืืฃ ืืึทื ืืึทืืึธืจืืฉืข ืืื ืจืึธืืข-ืืึทืืืจืืข ืฆืืืจืื ืืึธืืขืื ืฆื ืืึทืฉืืฆื ืกืืกืืขืืขื Linux ืงืขืื ืืขืืืขืืข ืกืื ืืช ืืื ืคืืจืจืขืืืื ืืขื ืคืืจ ืื ืืกืจืื ืืช ืคืื ืืืกืงืจืขืฉืึทื ืขืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื (DAC), ื ืืจืืืืฆืืื ืขื ืืื ืืงืก ืืืืขืจืืืื ืกืืกืืขื. ืืขืจ ืคึผืจืึธืืขืงื ืืึธื ืืื ืึธื ืืขืืืืื ืืื ืืขืจ ืื. ืขืก. ื ืึทืฆืืึธื ืึทืืขืจ ืืืืขืจืืืื ืึทืืขื ืืืจ, ืืื ืึทื ืืืืืงืืื ื ืืคึฟืจื ืืืจืืืขืคึฟืืจื ืืืจื ืงืึธื ืืจืึทืงืืึธืจื ืกืขืงืืืจ ืงืึธืืคึผืืืืื ื ืงืึธืจืคึผืึธืจืึทืฆืืข ืืื MITRE, ืืื ืืืื ืึท ืฆืึธื ืคึฟืึธืจืฉืื ื ืืึทืืึธืจืึทืืึธืจืืขืก.
Linux ืืืืขืจืืืึทื ืืึธืืืืขืก
ืืื ืืก ืืึธืจืืืึทืืืก ืืึธื ืืขืืึทืื ืึท ืฆืึธื ืืึทืืขืจืงืื ืืขื ืืืขืื ื ืฒึทืข NSA ืึทื ืืืืืงืืื ืืขื ืึผืื ืืื ืืึธืื ืงืขื ืขื ืึทืจืฒึทื ืืขื ืืืขื ืืืขืจื ืืื ืืขื ืืืืคึผืึพืืื ืืข ืงืขืจื ืขื. Linuxืขืจ ืืึธื ืืึทืฉืจืืื ืึท ืืขืืืื ืืึทืืข ืกืืืื, ืืื ืึท ืกืืื ืืื ืืขืจืกืขืคึผืืึธืจืก ืคึฟืึทืจ ืคืึทืจืืืึทืืื ืึธืืืขืงื ืึธืคึผืขืจืึทืฆืืขืก ืืื ืึท ืกืืื ืคึผืจืึทืืขืงืืืื ืคืขืืืขืจ ืืื ืงืขืจื ืขื ืืึทืื ืกืืจืืงืืืจื ืคึฟืึทืจ ืกืืึธืจืื ื ืื ืงืึธืจืขืกืคึผืึธื ืืื ื ืึทืืจืืืืืื. ืื ืกืืืื ืงืขื ืืขืืึธืื ืืืขืจื ืืขื ืืฆื ืืืจื ืืึธืืืึทืืึทื ืงืขืจื ืขื ืืึธืืืื ืฆื ืืืคึผืืึทืืขื ืืืจื ืงืืื ืืขืืืืื ืืฉืข ืืืืขืจืืืื ืืึธืืขื. LSM ืืื ืืขืืืึธืจื ืืึธืจ ืืื ืืขืืจืืจื ืืื ืื ืงืขืจื ืขื. Linux ืืืขืจืกืืข 2.6 ืืื 2003.
ืื LSM ืคืจืืืืืืขืจืง ืืืื ืืืื ืคืขืืืขืจ ืืื ืืึทืื ืกืืจืึทืงืืฉืขืจื ืืื ืจืืคื ืฆื ืื ืืขืจืกืขืคึผืฉืึทื ืคืึทื ืืงืฉืึทื ื ืืื ืงืจืืืืฉ ืคืื ืงืื ืืื ืื ืงืขืจื ืงืึธื ืฆื ืืึทื ืืคึผืืืืจื ืืื ืืื ืืืจืืคืืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื. ืขืก ืืืื ืืืกืืฃ ืคืึทื ืืงืฉืึทื ืึทืืืื ืคึฟืึทืจ ืจืขืืืฉืืกืืขืจืื ื ืืืืขืจืืืื ืืึทืืืฉืืื. ืื /sys/kernel/security/lsm ืฆืืืื ื ืึผืืื ืึท ืจืฉืืื ืคืื ืึทืงืืืื ืืึทืืืฉืืื ืืืืฃ ืื ืกืืกืืขื. LSM ืืืงืก ืืขื ืขื ืกืืึธืจื ืืื ืจืฉืืืืช ืืืึธืก ืืขื ืขื ืืขืจืืคึฟื ืืื ืื ืกืืจ ืกืคึผืขืกืืคืืขื ืืื CONFIG_LSM. ืืืืืืื ืืึทืงืืืืขื ืืืืฉืึทื ืืืืฃ ืืืงืก ืืื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืื ืืขืืขืจ ืืขืงืข include/linux/lsm_hooks.h.
ืื LSM ืกืืืกืืกืืขื ืืื ืขืจืืืืื ืื ืคืืืข ืืื ืืขืืจืืฆืืข ืคืื โโSELinux ืื ืืขืืืข ืืืขืจืกืืข ืคืื โโืื ืกืืืืืื ืงืขืจื ืขื Linux ืืืขืจืกืืข 2.6. ืืืฉ ืืืืื ืืจืื-ืืืจืLinux ืืื ืืขืืืึธืจื ืืขืจ ืืข ืคืึทืงืืึธ ืกืืึทื ืืึทืจื ืคึฟืึทืจ ืืืืขืจืข ืกืืืืืช Linux ืืื ืืื ืืขืืืึธืจื ืึท ืืืื ืคึฟืื ืื ืืขืจืกื ืคึผืึธืคึผืืืขืจืข ืืืกืืจืืืืืฆืืขืก: RedHat Enterprise Linux, ืคืขืืึธืจืึท, Debian, Ubuntu.
SE ืืืึธืกืึทืจLinux
- ืืืืขื ืืืืขื โ SE ืืึทื ืืฆืขืจLinux ื ืืฉื ืื ืืขืืืข ืืื ืื ืืขืืืืื ืืืขืืข ืืื ืืงืก/Linux ืืึทื ืืฆืขืจ ืืืืขื ืืืืขื, ืืื ืงืขื ืขื ืงืึธ-ืขืงืืืกืืืจื ืืืืฃ ืืขืจ ืืขืืืขืจ ืกืืกืืขื, ืึธืืขืจ ืืขื ืขื ืืึธืจ ืึทื ืืขืจืฉ ืืื ืขืกืขื ืฅ. ืืขืืขืจ ื ืึธืจืืึทื ืืฉืืื Linux ืงืขื ืคึผืึทืกื ืฆื ืืืื ืก ืึธืืขืจ ืืขืจ ืืื ืืจืื-ืืืจืLinuxSE ืืืืขื ืืืืขืLinux ืืื ืื ืืื ืืขืืจืืืขืจ ืืืื ืคืื ืืขื ืืืืขืืืื ืขื ืืืืขืจืืืื ืงืื ืืขืงืกื ืืืืก ืืืฉืืืื ืืืขืืืข ืืืืขืื ืขื ืืขื ืงืขื ืืจืืื ืืืื ืืื ืืืขืืืข ื ืืฉื.
- ืืึธืืืืื ื โ ืืื ืืจืืึพืืืจืLinux ื ืืืืขืื ืืื ืืขืจ ืืืืกืคืืจ ืงืื ืืขืงืกื ืคืื ื ืกืืืืขืงื, ื.ื. ื ืคืจืืฆืขืก. ื ืืืืขืื ืืืฉืืืื ืืืืื ืืขื ืฆืืืจืื ืืืืก ื ืคืจืืฆืขืก ืืื. ื ืืืืขืื ืืื ืืื ืขืืงืจ ื ืืืกืืข ืคืื โโืืืืก ืคืจืืฆืขืกื ืงืขื ืขื ืืื ืืืขืจ ืืืืกืคืืจื ืืงืฆืืขืก ื ืคืจืืฆืขืก ืงืขื ืืืืกืคืืจื ืืื ืคืืจืฉืืืขื ืข ืืืคื. ืขืืืืืข ืืืืฉืคืืื ืคืื ืืืืขืื ืก ืืขื ืขื sysadm_t ืคืืจ ืกืืกืืขื ืืืืื ืืกืืจืืฆืืข, ืืื user_t, ืืืืก ืืื ื ืจืขืืืืขืจืขืจ, โโื ืืฉื-ืคืจืืืืืืขืืืจืืขืจ ืืื ืืฆืขืจ ืืืืขืื. ืื init ืกืืกืืขื ืืืืคื ืืื ืื init_t ืืืืขืื, ืืื ืืขืจ ืคืจืืฆืขืก ืืืืก ืืืขืจื ืืขืจืืคื ืืืืคื ืืื ืื named_t ืืืืขืื.
- ืจืึธืืขืก โ ืืืึธืก ืืื ื ืืื ืึท ืคึฟืึทืจืืืืืขืจ ืฆืืืืฉื ืืึธืืขืื ืขื ืืื SE ืืึทื ืืฆืขืจLinuxืจืึธืืขืก ืืึทืฉืืืืขื ืฆื ืืืขืืืข ืืึธืืขืื ืขื ืึท ืืึทื ืืฆืขืจ ืงืขื ืืขืืขืจื ืืื ืืืึธืกืขืจืข ืืืคึผื ืึธืืืขืงืื ืืื ืงืขื ืขื ืฆืืืจืืื. ืื ืึทืงืกืขืก ืงืึธื ืืจืึธื ืืขืงืึทื ืืื ืคืึทืจืืื ืื ืกืึทืงืึธื ืข ืคืื โโืคึผืจืืืืืืขืืืข ืขืกืงืึทืืึทืฆืืข ืื ืคืืื. ืจืึธืืขืก ืืขื ืขื ืืื ืืขืืจืืจื ืืื ืื ืจืึธืืข-ืืึทืืืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื (RBAC) ืืืืขืจืืืื ืืึธืืขื ืืขื ืืฆื ืืื SE.Linux.
- ืืืืคึผืก - ื ืืืคึผ ืขื ืคืึธืจืกืืึทื ื ืจืฉืืื ืึทืืจืืืืื ืืืึธืก ืืื ืึทืกืืื ื ืฆื ืึท ืืืืคืขืฅ ืืื ืืืืขืจืืึทื ื ืืืขืจ ืงืขื ืขื ืึทืงืกืขืก ืขืก. ืขื ืืขื ืฆื ืื ืคืขืื ืืขืคึฟืื ืืฆืืข, ืึทืืืฅ ืึทื ืคืขืื ืึทืคึผืืืื ืฆื ืึท ืคึผืจืึธืฆืขืก, ืืื ืืืคึผ ืึทืคึผืืืื ืฆื ืึทืืืืฉืขืงืฅ ืึทืืึท ืืื ืืืจืขืงืืขืจืื, ืืขืงืขืก, ืกืึทืงืึทืฅ, ืขืืง.
- ืืขืืขืก ืืื ืึทืืืืฉืขืงืฅ - ืคึผืจืึทืกืขืกืึทื ืืขื ืขื ืกืึทืืืืฉืขืงืฅ ืืื ืืืืคื ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืงืึธื ืืขืงืกื ืึธืืขืจ ืืืืขืจืืืื ืคืขืื. ืึทืคึผืขืจืืืืื ื ืกืืกืืขื ืจืขืกืืจืกื: ืืขืงืขืก, ืืืืจืขืงืืขืจืื, ืกืึทืงืึทืฅ, ืืื"ื ื, ืืขื ืขื ืึทืืืืฉืขืงืฅ ืืืึธืก ืืขื ืขื ืึทืกืืื ื ืึท ืืืืขืจ ืืืคึผ, ืืื ืื ืืขืจืข ืืืขืจืืขืจ, ืึท ืคึผืจืืืืึทืืงืืื ืืืจืื.
- SE ืคึผืึธืืืืืงืกLinux - ืฆื ืืึทืฉืืฆื ืื SE ืกืืกืืขืLinux ื ืืฆื ื ืคืืจืฉืืืื ืงืืื ืคืื ืคืืืืกืืก. SE ืคืืืืกืLinux ืืขืคืื ืืจื ืืึทื ืืฆืขืจ ืฆืืืจืื ืฆื ืจืึธืืขืก, ืจืึธืืขืก ืฆื ืืึธืืขืื ืขื, ืืื ืืึธืืขืื ืขื ืฆื ืืืคึผื. ืขืจืฉืื ืก, ืึท ืืึทื ืืฆืขืจ ืืื ืืืจืขืืืืื ืฆื ืึท ืจืึธืืข, ืืขืจื ืึธื ืึท ืจืึธืืข ืืื ืืืจืขืืืืื ืฆื ืฆืืืจืื ืืึธืืขืื ืขื. ืฆืื ืกืืฃ, ืึท ืืึธืืขืื ืงืขื ืืึธืื ืฆืืืจืื ืืืืื ืฆื ืืืืขืจืข ืึธืืืขืงื ืืืคึผื.
LSM ืืื SE ืืจืืืืขืงืืืจLinux
ืืจืึธืฅ ืืขื ื ืึธืืขื, ืืขื ืขื LSMs ื ืืฉื ืืึทืงืข ืืึธืืืึทืืึทื ืืึธืืืื. Linuxืืืขืจ, ืคืื ืงื ืืื SELinux, ืขืก ืืื ืืืืื ืืื ืืขืืจืืจื ืืื ืืขื ืงืขืจื ืขื. ืืขืืข ืขื ืืขืจืื ื ืฆืื LSM ืงืืืื ืงืืื ืคืืจืืื ืื ื ื ืืืข ืงืขืจื ืขื ืงืืืคืืืืฆืืข. ืื ืงืืจืขืกืคืื ืืืจื ืืข ืืคืฆืืข ืืื ืืืื ืขื ืืืืึทืื ืืื ืื ืงืขืจื ืขื ืกืขืืื ืืก, ืื ืืขืจืฉ ืืืขื ืืขืจ LSM ืงืืื ื ืืฉื ืืืขืจื ืืงืืืืืืจื ื ืื'ื ืืื. ืืืขืจ, ืืคืืื ืืื ืืขื ืคืื, ืงืขื ืขืก ืืืขืจื ืขื ืืืืึทืื ืืืจื ืื OS ืืืืืืืขืจ ืืคืฆืืข.
LSM ืืฉืขืง ืึธื ืืืืื
LSM ืืื ืืงืืืืคึผื ืืื ืืืงืก ืืื ืืึทืจืฅ ืงืขืจื ืคืึทื ืืงืฉืึทื ื ืืืึธืก ืงืขื ืขื ืืืื ืืึทืืืึทืืืง ืคึฟืึทืจ ืืฉืขืงืก. ืืืื ืขืจ ืคืื ืื ืืืืคึผื ืคึฟืขืึดืงืืืื ืคืื LSMs ืืื ืึทื ืืื ืืขื ืขื ืกืืึทืงื. ืืืื, ืื ื ืึธืจืืึทื ืืฉืขืงืก ืืขื ืขื ื ืึธื ืืืจืืืขืงืึธืื, ืืื ืืขืืขืจ ืฉืืืืข ืคืื โโโโืืกื ืืืืื ืืืกืืฃ ื ืึธื ืงืึธื ืืจืึธืืก ืืื ืงืึธื ืืจืึธืืก. ืืืก ืืืื ื ืื ืืขื ืงืขื ื ืืฉื ืฆืืจืืงืฆืืขื ืืขื ืืืกืืจ. ืืึธืก ืืื ืืขืืืืื ืืื ืื ืคืืืืจ; ืืืื ืืขืจ ืจืขืืืืืึทื ืคืื ืจืืืื DAC ืืฉืขืงืก ืืื ืึท ืืืจืืคืึทื, ืืขืจ ืขื ืื ืืืขื ื ืืฉื ืืคืืื ืืขืจืืจืืืื ืื LSM ืืืงืก.
SELinux ืืื ืื ืืขื ืืืขื ืื Flask ืืืืขืจืืืื ืืจืืืืขืงืืืจ ืคืื ืื Fluke ืคืืจืฉืื ื ืืคืขืจืืจื ืกืืกืืขื, ืกืคืขืฆืืขื ืืขื ืคืจืื ืฆืืค ืคืื ืงืืขื ืกืืข ืคืจืืืืืืขืืืข. ืื ืขืกืขื ืฅ ืคืื ืืขื ืงืื ืฆืขืคื, ืืื ืืขืจ ื ืืืขื ืืืื, ืืื ืฆื ืืขืื ื ืืื ืืฆืขืจ ืืืขืจ ืคืจืืฆืขืก ื ืืจ ืื ืจืขืืื ืืืืก ืืขื ืขื ื ืืืืื ืฆื ืืืจืืคืืจื ืื ืืขืืืืื ืืฉืข ืืงืฆืืข. ืืขืจ ืคืจืื ืฆืืค ืืืขืจื ืืืืคืืขืืขื ืืืจื ืืืจื ืคืืจืคืืืืืขืืข ืฆืืืจืื ืืืืคืื ื, ืืืื ืงืื ืืจืืืืจื ืืื ืฆืืืจืื ืจืขืืื ืืื SE.Linux ืืึทืืืจื ืืืืฃ ืืขื ืืึธืืขืื => ืืืคึผ ืืึธืืขื.
ืืื ืง ืืขื ืืขืฆืืืืื ืืขื ืขื ืืืืคื ืคืื access SELinux ืืื ืคืื ืืขืจ ืืึทืืืืื ืืืงืข ืึทืงืกืขืก ืงืึธื ืืจืึธื ืงืืืคึผืึทืืืืึทืืื ืืื ืื ืืจืึทืืืฆืืึธื ืขืืข DAC ืืึธืืขื ืืขื ืืฆื ืืื ืืื ืืงืก ืึธืคึผืขืจืืจื ืกืืกืืขื.Linuxืืืฉื, ืืืจ ืงืขื ื ืืืืจืขื ืขืฆื ืืขื ื ืขืฅ ืคึผืึธืจื ื ืืืขืจ ืืืืฃ ืืืขืืื ืืขืจ FTP ืกืขืจืืืขืจ ืืืขื ืืขืจื, ืืขืจืืืืื ืืืง ืฉืจืืืื ืืื ืืึธืืืคืืฆืืจื ืืขืงืขืก ืืื ืึท ืกืคึผืขืฆืืคึฟืืฉื ืืขืงืข, ืึธืืขืจ ื ืืฉื ืืืืกืืขืงื ืืื.
ืืืืคึผื ืงืึธืืคึผืึธื ืขื ืื ืคืื SELinux ืืขื ืขื ืืื ืคืืืื ื:
- ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ - ืื ืืืืคึผื ืืขืงืึทื ืืืึทื ืคึฟืึทืจ ืึธืจืืึทื ืืืืื ื ืึทืงืกืขืก ืงืึธื ืืจืึธื.
- ืกืืกืืขื ืืืืขืจืืืื ืคึผืึธืืืืืง ืืึทืืึทืืืืก.
- ืื ืืขืจืึทืงืฉืึทื ืืื ืื LSM ืืขืฉืขืขื ืืฉ ืื ืืขืจืกืขืคึผืืึธืจ.
- Selinuxfs โ ื ืคึผืกืขืืืืึธ-FS, ืื ืืขืืืข ืืื /proc ืืื ืืึธื ืืืจื ืืื /sys/fs/selinux. ืืื ืึทืืืฉ ืืึทืคืขืืงืขืจื ืืืจื ืื ืงืขืจื ืขื. Linux ืืขืช ืืืืกืคืืจืื ื ืืื ืื ืืืืื ืืขืงืขืก ืืื ืืื ืคืืจืืืฆืืข ืืืขืื ืืขื SE ืกืืืืืกLinux.
- ืึทืงืกืขืก ืืืขืงืืึธืจ ืงืึทืฉ - ืึทื ืึทืืืืืืขืจื ืืขืงืึทื ืืืึทื ืคึฟืึทืจ ืื ืงืจืืกืื ื ืคึผืจืึธืืืึทืงืืืืืึทืื.
SE ืึธืคึผืขืจืึทืฆืืข ืกืืขืืขLinux
ืขืก ืึทืืข ืึทืจืืขื ืืื ืืึธืก.
- ื ืืขืืืืกืข ืืขืืข, ืืื SE ืืขืจืืื ืขืLinux, ืคืืจื ืืืืก ืื ืขืจืืืืืืข ืืงืฆืืข ืืืืฃ ืืขื ืืืืขืงื ื ืื ืื DAC ืืืขืจืืคืืงืืฆืืข, ืืื ืืขืืืืื ืืื ืืืื ืืืืื. ืื ืคืืจืืื ื ืฆื ืืืจืืคืืจื ืื ืืคืขืจืืฆืืข ืืืขืจื ืืจืืืขืจืืขืืขืื ืฆืื LSM ืืขืฉืขืขื ืืฉ ืืื ืืขืจืฆืขืคืืืจ.
- ืคืื ืืืจื, ืืืขืจื ืื ืคืืจืืื ื, ืฆืืืืืขื ืืืื ืืืืขืจืืืื ืงืื ืืขืงืกื ืคืื ืืขื ืกืืืืขืงื ืืื ืืืืขืงื, ืืจืืืขืจืืขืืขืื ืฆืื SE ืืืืื.Linux ืึทืืกืืจืึทืงืฆืืข ืืื ืืืง ืืึธืืืง, ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืื ืืขืจืึทืงืฆืืข ืืื LSM.
- ืื ืืึทืฉืืืก-ืืืื ืืืงืข ืืืืืึธืจืืืขื ืืืขืื ืึท ืกืืืืขืงื'ืก ืฆืืืจืื ืฆื ืึทื ืึธืืืขืงื ืืื ืืขืจ ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืขืจ, ืืื ืขืก ืืึทืงืืื ืืึทืื ืคืื ืื SE.Linux ืึทื ืื.
- ืฆื ืืึทืื ืืืกืืืฉืึทื ื ืืืขืื ืึทืงืกืขืก ืึธืืขืจ ืึธืคึผืืืืงืขื ืื ื, ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ ืืืจื ืก ืฆื ืื ืึทืงืกืขืก ืืืขืงืืึธืจ ืงืึทืฉ (AVC) ืงืึทืืฉืื ื ืกืึทืืกืืกืืึทื ืคึฟืึทืจ ืื ืืขืจืกื ืืขืืืืื ื ืึผืืืื.
- ืืืื ืึท ืืืืืื ื ืคึฟืึทืจ ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืขืจืฉื ืืื ื ืืฉื ืืขืคึฟืื ืขื ืืื ืื ืงืึทืฉ, ืื ืืขืื ืืื ืืืจืืืขืืื ืืขื ืฆื ืื ืืืืขืจืืืื ืคึผืึธืืืืืง ืืึทืืึทืืืืก.
- ืืขืจ ืืืื ืจืขืืืืืึทื ืคืื ืื ืืึทืืึทืืืืก ืืื AVC ืืื ืืืืืขืงืขืจื ืฆื ืื ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ.
- ืืืื ืื ืืขืคืื ืขื ืคึผืึธืืืืืง ืฉืืืขืืขืืขื ืื ืืขืืขืื ืงืึทืืฃ, ืื ืึธืคึผืขืจืึทืฆืืข ืืื ืขืจืืืืื. ืึทื ืืขืจืฉ, ืื ืึธืคึผืขืจืึทืฆืืข ืืื ืคึผืจืึธืืืืืึทืืึทื.
ืคืึทืจืืืึทืืื SE ืกืขืืืื ืืกLinux
SELinux ืึทืจืืขื ืืื ืืืื ืขื ืคึฟืื ืืจืฒึท ืืึธืืขืก:
- ืขื ืคืึธืจืกืื ื - ืฉืืจืขื ื ืึทืืืืจ ืฆื ืืืืขืจืืืื ืคึผืึทืืึทืกืื.
- ืคึผืขืจืืืกืืื - ืืืืขื ืคืื ืจืืกืืจืืงืฉืึทื ื ืืื ืขืจืืืืื; ืึท ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืึธื ืืื ืืขืืืื ืืื ืืขื ืืฉืืจื ืึทื.
- ืคืึทืจืงืจืืคึผืื - ืืืืขืจืืืื ืคึผืึทืืึทืกืื ืืขื ืขื ื ืืฉื ืืื ืืืืจืงืื ื.
ืืขื ืืื ืืืึธืกืขืจ ืืึธืืข SE ืืืLinux ืืืจ ืงืขื ื ืขืก ืืึธื ืืืื ืคืืืื ืื ืืึทืคึฟืขื.
[admin@server ~]$ getenforce
Permissiveืืฉืึทื ืืื ื ืื ืืึธืืข ืืืืืขืจ ืจืืกืืึทืจืืื ื, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืึทืฉืืขืืืงื ืขืก ืฆื ืขื ืคืึธืจืกืื ื, ืึธืืขืจ 1. ืืขืจ ืคึผืขืจืืืกืืื ืคึผืึทืจืึทืืขืืขืจ ืงืึธืจืึทืกืคึผืึทื ืื ืฆื ืื ื ืืืขืจืืง ืงืึธื 0.
[admin@server ~]$ setenfoce enforcing
[admin@server ~]$ setenfoce 1 #ัะพ ะถะต ัะฐะผะพะต
ืืืจ ืงืขื ืขื ืืืื ืืืืฉื ืื ืืึธืืข ืืืจื ืขืืืืื ื ืื ืืขืงืข:
[admin@server ~]$ cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE = ืฆืื
ืืขืจ ืืืืืง ืืื setenfoce ืืื ืื ืืืขื ืื ืืคืขืจืืจื ืกืืกืืขื ืืื, ืื SE ืืึธืืขLinux ืืืขื ืืืขืจื ืืขืฉืืขืื ืืืืื ืืืขืจื ืคืื ืืขื SELINUX ืงืื ืคืืืืจืืฆืืข ืืขืงืข ืคืืจืืืขืืขืจ. ืืขืจืฆื, ืขื ืืขืจืื ืืขื ืฆื ืืขืจ "enforcering <=> disabled" ืกืขืืื ื ื ืขืืขื ืงืจืืคื ื ืืจ ื ืืืืขื ืืืืก ืืขื ืืื ืจืขืืืงืืืจื ืืขื /etc/selinux/config ืืขืงืข ืืื ื ืื ื ืจืืกืืืจื.
ืืขื ืึท ืงืืจืฅ ืกืืึทืืืก ืืึทืจืืื:
[admin@server ~]$ sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 31
ืฆื ืืขื SE ืึทืืจืืืืืืLinux ืขืืืขืืข ื ืึธืจืืึทืืข ืืืืืืึทืืื ื ืืฆื ืืขื -Z ืคึผืึทืจืึทืืขืืขืจ.
[admin@server ~]$ ls -lZ /var/log/httpd/
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20200920
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20200927
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20201004
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20201011
[admin@server ~]$ ps -u apache -Z
LABEL PID TTY TIME CMD
system_u:system_r:httpd_t:s0 2914 ? 00:00:04 httpd
system_u:system_r:httpd_t:s0 2915 ? 00:00:00 httpd
system_u:system_r:httpd_t:s0 2916 ? 00:00:00 httpd
system_u:system_r:httpd_t:s0 2917 ? 00:00:00 httpd
...
system_u:system_r:httpd_t:s0 2918 ? 00:00:00 httpdืงืึทืืคึผืขืจื ืืื ืืขืจ ื ืึธืจืืึทื ืจืขืืืืืึทื ืคืื ls -l, ืขืก ืืขื ืขื ืขืืืขืืข ื ืึธื ืคืขืืืขืจ ืืื ืื ืคืืืืขื ืืข ืคึฟืึธืจืืึทื:
<user>:<role>:<type>:<level>
ืื ืืขืฆืืข ืคืขืื ืืื ืึธืืฅ ืขืคึผืขืก ืืื ืึท ืืืืขืจืืืื ืงืืึทืกืึทืคืึทืงืืืฉืึทื ืืื ืืืฉืืืื ืคืื ืึท ืงืึธืืืื ืึทืฆืืข ืคืื โโโโืฆืืืื ืขืืขืืขื ืื:
- s0 - ืืึทืืืึทื, ืืืื ืืขืฉืจืืื ืืื ื ืืืขืจืืง-ืืืื ืืขืืึทืืขื
- c0, c1โฆ c1023 - ืงืึทืืขืืึธืจืืข.
ืืฉืึทื ืืื ื ืึทืงืกืขืก ืงืึทื ืคืืืืขืจืืืฉืึทื
ื ืืฆื ืกืขืืึธืืืืข ืฆื ืืึธืื SE ืืึธืืืืLinux, ืฆืืืืืื ืืื ืึทืจืึธืคึผื ืขืืขื ืืื.
[admin@server ~]$ semodule -l |wc -l #ัะฟะธัะพะบ ะฒัะตั
ะผะพะดัะปะตะน
408
[admin@server ~]$ semodule -e abrt #enable - ะฐะบัะธะฒะธัะพะฒะฐัั ะผะพะดัะปั
[admin@server ~]$ semodule -d accountsd #disable - ะพัะบะปััะธัั ะผะพะดัะปั
[admin@server ~]$ semodule -r avahi #remove - ัะดะฐะปะธัั ะผะพะดัะปัืขืจืฉืืขืจ ืืึทื ืฉืึทืคึฟื ืืึธืืื ืืึธืืื ืคึฟืึทืจืืื ืื ืืขื SE ืืึทื ืืฆืขืจLinux ืืืื ืืคืขืจืืจื ืกืืกืืขื ืืื ืืฆืขืจ, ืืืืืื ืื ืฆืืืืืืข ืื ืืืกืืข. ืฆืื ืกืืฃ, ืืขืจ ืืขืฆืืขืจ ืืืคืขื ืืืื -r ืกืืืืืฉ ื ืขืื ืืืืขืง ืื SE ืืื ืืฆืขืจ ืืขืคึผืื ืLinux ืฆื ืึธืคึผืขืจืืจื ืกืืกืืขื ืึทืงืึทืื ืืก. ืื ืกืื ืืึทืงืก ืคืื MLS/MCS ืงืืื ืืืขืจืื ืืื ืืขืจืงืืขืจื ืืื ืื ืคืจืืขืจืืืงืข ืกืขืงืฆืืข.
[admin@server ~]$ semanage login -a -s user_u karol
[admin@server ~]$ semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
system_u system_u s0-s0:c0.c1023 *
[admin@server ~]$ semanage login -d karol
ืงืึธืืขืงืืืื ืกืขืืึทื ืึทืืข ืืึทื ืืฆืขืจ ืืขื ืืฆื ืฆื ืคืืจื ืืึทืคึผืื ืืก ืฆืืืืฉื ืืึทื ืืฆืขืจ ืืื SE ืจืึธืืขืกLinux.
[admin@server ~]$ semanage user -l
Labeling MLS/ MLS/
SELinux User Prefix MCS Level MCS Range SELinux Roles
guest_u user s0 s0 guest_r
staff_u staff s0 s0-s0:c0.c1023 staff_r sysadm_r
...
user_u user s0 s0 user_r
xguest_u user s0 s0 xguest_r
[admin@server ~]$ semanage user -a -R 'staff_r user_r'
[admin@server ~]$ semanage user -d test_uืืึทืคึฟืขืื ืคึผืึทืจืึทืืขืืขืจืก:
- - ืึท ืืืืื ืื ืื ืจืึธืืข ืืึทืคึผืื ื ืคึผืึธืืืฆืืข;
- -ื ืจืฉืืื ืคืื ืืืึธืก ืจืืืื ื ืืฆืขืจืก ืืื ืจืึธืืขืก;
- -ื ืืืกืืขืงื ืืึทื ืืฆืขืจ ืจืึธืืข ืืึทืคึผืื ื ืคึผืึธืืืฆืืข;
- -ืจ ืจืฉืืื ืคืื ืจืึธืืขืก ืึทืืึทืืฉื ืฆื ืืขืจ ืืึทื ืืฆืขืจ;
ืืขืงืขืก, ืคึผืึธืจืฅ ืืื ืืืืืึทื ืืืึทืืืขืก
ืืขืืขืจ SE ืืึธืืืLinux ืืื ื ืกืขื ืคืื ืืขืงืข-ืืืจืงืืจืื ื-ืจืขืืืืืฆืืขืก, ืืืขืจ ืืืจ ืงืขื ื ืืืื ืฆืืืืืื ืืืืขืจืข ืืืืืขื ืข ืจืขืืืืืฆืืขืก ืืืื ื ืืืืื. ืืืฉื, ืืืจ ืืืืื ืืขืื ืืขื ืืืขื ืกืขืจืืืขืจ ืฆืืืจืื-ืจืขืืื ืฆืื /srv/www ืืขืงืข.
[admin@server ~]$ semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?
[admin@server ~]$ restorecon -R /srv/www/ืืขืจ ืขืจืฉืืขืจ ืืึทืคึฟืขื ืจืขืืืฉืืกืืขืจื ื ืืึท ืืึทืจืงืื ื ืึผืืืื, ืืื ืื ืจืืข ืจืืกืขืฅ, ืึธืืขืจ ืืึทื ืฅ ืฉืืขืื, ืื ืืขืงืข ืืืืคึผืก ืืื ืืืื ืืื ืื ืงืจืึทื ื ืึผืืืื.
ืคึผืื ืงื ืึทืืื, TCP / UDP ืคึผืึธืจืฅ ืืขื ืขื ืื ืืขืฆืืืื ื ืืื ืึทืืึท ืึท ืืืขื ืึทื ืืืืื ืื ืฆืื ืขืืขื ืืึทืืื ืื ืืก ืงืขื ืขื ืืขืจื ืืืืฃ ืืื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืื ืกืืจ ืคึฟืึทืจ ืื ืืืขื ืกืขืจืืืขืจ ืฆื ืืขืจื ืืืืฃ ืคึผืึธืจื 8080, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืคื ืื ืืึทืคึฟืขื.
[admin@server ~]$ semanage port -m -t http_port_t -p tcp 8080ื ืืึทืืืืืืงืข ืฆืึธื ืคืื SE ืืึธืืืืLinux ืืืื ืคืืจืืืขืืขืจืก ืืืืก ืงืขื ืขื ื ืขืืขื ืืืืืึทื ืืืขืจืื. ืื ืคืืืข ืืืกืืข ืคืื โโืืืขืืืข ืคืืจืืืขืืขืจืก ืงืขื ืืขื ืืขื ื ืืฆื ืืืง getsebool -a. ืืืืืึทื ืืืขืจืื ืงืขื ืขื ืืขืขื ืืขืจื ืืืขืจื ื ืืฆื ืืืง setsebool.
[admin@server ~]$ getsebool httpd_enable_cgi
httpd_enable_cgi --> on
[admin@server ~]$ setsebool -P httpd_enable_cgi off
[admin@server ~]$ getsebool httpd_enable_cgi
httpd_enable_homedirs --> off
ืืืึทืจืฉืืึทื, ืืึทืงืืืขื ืึทืงืกืขืก ืฆื ืื Pgadmin-ืืืขื ืฆืืืื ื
ืืึธืืืจ ืืขื ืึท ืคึผืจืึทืงืืืฉ ืืืึทืฉืคึผืื: ืืืจ ืืื ืกืืึทืืืจื pgadmin7.6-web ืืืืฃ RHEL 4 ืฆื ืคืืจื ืื PostgreSQL ืืึทืืึทืืืืก. ืื ืจ ืืฒื ืข ื ืืขืืื ืืข ื ื ืืืกื ืืื ืื ืกืขืืืื ืืก ืคืื pg_hba.conf, postgresql.conf ืืื config_local.py, ืฉืืขืื ืืขืงืข ืคึผืขืจืืืฉืึทื ื, ืืื ืกืืึทืืืจื ืื ืคืขืื ืืืง ืคึผืืืืึธื ืืึทืืืฉืืื ืคึฟืื ืคึผืืคึผ. ืึทืืฅ ืืื ืืจืืื, ืืืจ ืงืึทืืขืจ ืืื ืืึทืงืืืขื 500 ืืื ืขืจืืขืืขืจ ืกืขืจืืืืจืขืจ ืืขืืช.
ืืืจ ืึธื ืืืืื ืืื ืื ืืืคึผืืฉ ืกืึทืกืคึผืขืงืฅ, ืืฉืขืง /var/log/httpd/error_log. ืขืก ืืขื ืขื ืขืืืขืืข ืืฉืืงืึทืืืข ืืืื ืกื ืืึธืจื.
[timestamp] [core:notice] [pid 23689] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
...
[timestamp] [wsgi:error] [pid 23690] [Errno 13] Permission denied: '/var/lib/pgadmin'
[timestamp] [wsgi:error] [pid 23690]
[timestamp] [wsgi:error] [pid 23690] HINT : You may need to manually set the permissions on
[timestamp] [wsgi:error] [pid 23690] /var/lib/pgadmin to allow apache to write to it.
ืืึธ ืืขื ืขื ืื ืืขืจืืืื ืคืื ืึทืืืื ืืกืืจืึทืืึธืจื Linux ืขืก ืืืขื ืืืื ื ืฉืืืจืงืข ืคืืจืืื ืฆื ืืืืคื setencorce 0, ืืื ืืืก ืืื ืืขืจ ืกืืฃ ืืขืจืคืื. ืขืจืืขื ืืขืืืื, ืืืก ืืื ืืืืก ืืื ืืื ืืขืืื ืืืก ืขืจืฉืืข ืืื. ืืืก ืืื ืืืืขืจ ื ืืืืืื ื, ืืืขืจ ืืืืื ืคืื ืื ืืขืกืืข.
ืืจืึธืฅ ืื ืืจืืืกืงืืื ืคืื ืื SE ืืืืืื ืกLinux ืขืก ืงืขื ืืืื ืืึทื ืืฆืขืจ-ืคึฟืจืฒึทื ืืืขื. ืคืฉืื ืืื ืกืืึทืืืจื ืืขื setroubleshoot ืคึผืขืงื ืืื ืืขื ืืขื ืกืืกืืขื ืืึธื.
[admin@server ~]$ yum install setroubleshoot
[admin@server ~]$ journalctl -b -0
[admin@server ~]$ service restart auditd
ืืืืข ืืึธื ืึทื ืื ืึทืืืื ืกืขืจืืืืก ืืืื ืืืื ืจืืกืืึทืจืืื ืืขื ืืืขื, ืืื ื ืืฉื ื ืืฆื ืกืืกืืขืืงืื, ืืจืึธืฅ ืืขื ืืืึทืืืึทื ืคืื ืกืืกืืขื ืืื ืื ืึทืก. ืืื ืื ืกืืกืืขื ืงืืึธืฅ ืืืขื ืืืื ืื ืืขืืืืื ื ืื ืืืืื ืื ืคืึทืงื ืคืื ืืืึทืงืื ื, ืึธืืขืจ ืืืื ืื ืกืืื ืืื ืืืขื ืฆื ืืึทืงืืืขื ืืขื ืคืึทืจืืึธื.
ืืืจ ืืืกืคืืจื ืื ืงืึทืืึทื ืื:
[admin@server ~]$ setsebool -P httpd_can_network_connect 1
[admin@server ~]$ setsebool -P httpd_can_network_connect_db 1
ืืืจ ืงืึธื ืืจืึธืืืจื ืึทืงืกืขืก ืฆื ืื pgadmin4-ืืืขื ืืืึทื, ืึทืืฅ ืึทืจืืขื.
ืืงืืจ: www.habr.com
