ืืืื ืขืจ ืคืื ืื ืกืืืืช ืคึฟืึทืจ ืื ืืืืึทืืืืง ืืฆืืื ืคืื ืื ืืื ืืงืก ืึทืก ืืืืฃ ืขืืืขืืื, ืจืืจืขืืืืืง ืืขืืืืกืขืก ืืื ืกืขืจืืืขืจืก ืืื ืื ืืึทื ืฅ ืืืื ืืืืขืจืืืื ืคืื ืื ืงืขืจื, ืคึฟืึทืจืืื ืืขื ืข ืืึทืืื ืื ืืก ืืื ืึทืคึผืืึทืงืืืฉืึทื ื. ืืืขืจ ืืืื ืฆื ืื ืึทืจืงืึทืืขืงืืฉืขืจ ืคืื ืื ืืื ืืงืก ืงืขืจื, ืขืก ืืื ืืืืืขืืืขื ืฆื ืืขืคึฟืื ืขื ืืื ืขืก ืึท ืงืืืึทืืจืึทื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืืืืขืจืืืื ืืื ืึทืืึท. ืืื ืืื ืื ืืื ืืงืก ืืืืขืจืืืื ืกืึทืืกืืกืืึทื ืืืืืื ื ืืื ืืืึธืก ืืื ืขืก?
ืืื ืืขืจืืจืื ื ืืืืฃ ืืื ืืงืก ืกืขืงืืจืืื ืืึธืืืืขืก ืืื SELinux
ืืืืขืจืืืื ืขื ืืึทื ืกื ืืื ืืงืก ืืื ืึท ืกืืื ืคืื ืึผืืืื ืืื ืึทืงืกืขืก ืืขืงืึทื ืืืึทืื ืืืืืจื ืืืืฃ ืืึทื ืืึทืืึธืจื ืืื ืจืึธืืข-ืืืืืจื ืึทืงืกืขืก ืืึธืืขืืก ืฆื ืืึทืฉืืฆื ืืื ืืงืก ืกืืกืืขืืขื ืคืื ืคึผืึธืืขื ืฆืืขื ืืจืขืฅ ืืื ืคืึทืจืจืืืื ืื ืฉืึธืจืืงืึธืืื ืืก ืคืื ืืืกืงืจืขืฉืึทื ืขืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื (ืืึทืง), ืื ืืจืืืืฆืืื ืขืื ืืื ืืงืก ืืืืขืจืืืื ืกืืกืืขื. ืืขืจ ืคืจืืืขืงื ืืื ืขืจืืืืฉืึทื ืืืืึทื ืืื ืื ืืขืืขืจืขื ืคืื ืื ืื. ืขืก. ื ืึทืฉืึทื ืึทื ืกืขืงืืจืืื ืึทืืขื ืืืจ, ืืื ืืื ืืืืื ืืขืืืขืืึธืคึผืขื ืืขืจ ืืืืคึผื ืืืจื ืงืึธื ืืจืึทืงืืึธืจืก ืกืขืงืืจืข ืงืึทืืคึผืืืืื ื ืงืึธืจืคึผืึธืจืึทืืืึธื ืืื MITER, ืืื ืืขืืื ื ืืื ืึท ื ืืืขืจ ืคืื ืคืึธืจืฉืื ื ืืึทืืึธืจืึทืืึธืจืืขืก.
ืืื ืืงืก ืืืืขืจืืืื ืืึธืืืืขืก
Linus Torvalds ืืื ืืขืืืื ืึท ื ืืืขืจ ืคืื ืืึทืืขืจืงืื ืืขื ืืืขืื ื ืืึทืข NSA ืืืืืขืืึทืคึผืืึทื ืฅ ืึทืืื ืืื ืงืขื ืขื ืืืื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืื ืืืืคึผื ืืื ืืงืก ืงืขืจื. ืขืจ ืืืกืงืจืืืื ืึท ืืขื ืขืจืึทื ืกืืืืืืข, ืืื ืึท ืืึทื ื ืคืื ืื ืืขืจืกืขืคึผืืึธืจืก ืฆื ืงืึธื ืืจืึธืืืจื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืึทืืืืฉืขืงืฅ ืืื ืึท ืืึทื ื ืคืื ืืืืขืจ ืคึผืจืึทืืขืงืืืื ืคืขืืืขืจ ืืื ืงืขืจื ืขื ืืึทืื ืกืืจืึทืงืืฉืขืจื ืฆื ืงืจืึธื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืึทืืจืืืืืฅ. ืื ืกืืืืืืข ืงืขื ืขื ืืืื ืืขืืืืื ื ืืืจื ืืึธืืืึทืืืข ืงืขืจื ืืึทืืืฉืืื ืฆื ืื ืกืืจืืืขื ื ืงืืื ืืขืืืืื ืืืืขืจืืืื ืืึธืืขื. LSM ืืื ืืึธืจ ืืจืืื ืืื ืื ืืื ืืงืก ืงืขืจื ืื2.6 ืืื 2003.
ืื LSM ืคืจืืืืืืขืจืง ืืืื ืืืื ืคืขืืืขืจ ืืื ืืึทืื ืกืืจืึทืงืืฉืขืจื ืืื ืจืืคื ืฆื ืื ืืขืจืกืขืคึผืฉืึทื ืคืึทื ืืงืฉืึทื ื ืืื ืงืจืืืืฉ ืคืื ืงืื ืืื ืื ืงืขืจื ืงืึธื ืฆื ืืึทื ืืคึผืืืืจื ืืื ืืื ืืืจืืคืืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื. ืขืก ืืืื ืืืกืืฃ ืคืึทื ืืงืฉืึทื ืึทืืืื ืคึฟืึทืจ ืจืขืืืฉืืกืืขืจืื ื ืืืืขืจืืืื ืืึทืืืฉืืื. ืื /sys/kernel/security/lsm ืฆืืืื ื ืึผืืื ืึท ืจืฉืืื ืคืื ืึทืงืืืื ืืึทืืืฉืืื ืืืืฃ ืื ืกืืกืืขื. LSM ืืืงืก ืืขื ืขื ืกืืึธืจื ืืื ืจืฉืืืืช ืืืึธืก ืืขื ืขื ืืขืจืืคึฟื ืืื ืื ืกืืจ ืกืคึผืขืกืืคืืขื ืืื CONFIG_LSM. ืืืืืืื ืืึทืงืืืืขื ืืืืฉืึทื ืืืืฃ ืืืงืก ืืื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืื ืืขืืขืจ ืืขืงืข include/linux/lsm_hooks.h.
ืื LSM ืกืึทืืกืืกืืขื ืืขืืืื ืขืก ืืขืืืขื ืฆื ืคืึทืจืขื ืืืงื ืื ืคืื ืื ืึทืืจืืืฉืึทื ืคืื SELinux ืืื ืืขืจ ืืขืืืืงืขืจ ืืืขืจืกืืข ืคืื โโโโืื ืกืืึทืืื ืืื ืืงืก ืงืขืจื ืื2.6. SELinux ืืื ืึผืืขื ืืืืื ืืขืืืืจื ืืขืจ ืืข ืคืึทืงืืึธ ื ืึธืจืืึทื ืคึฟืึทืจ ืึท ืืืืขืจ ืืื ืืงืก ืกืืืืืืข ืืื ืืื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืื ืืขืจืกื ืคืึธืืงืก ืืืกืืจืืืืืฉืึทื ื: RedHat Enterprise Linux, Fedora, Debian, Ubuntu.
SELinux ืืืึธืกืึทืจ
- ืืืืขื ืืืืขื - ืืขืจ SELinux ืืึทื ืืฆืขืจ ืืื ื ืืฉื ืื ืืขืืืข ืืื ืื ืืขืืืืื ืืืขื ืืื ืืงืก / ืืื ืืงืก ืืึทื ืืฆืขืจ ืฉืืึทื; ืืื ืงืขื ืขื ืงืึธืืืืืืกืืืจื ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ืกืืกืืขื, ืึธืืขืจ ืืขื ืขื ืืึธืจ ืึทื ืืขืจืฉ ืืื ืขืกืึทื ืก. ืืขืืขืจ ื ืึธืจืืึทื ืืื ืืงืก ืืฉืืื ืงืขื ืขื ืฉืืืืขื ืฆื ืืืื ืขืจ ืึธืืขืจ ืืขืจ ืืื SELinux. ืื SELinux ืืืืขื ืืืืขื ืืื ืึท ืืืื ืคืื ืื ืงืืืืขืืืืง ืืืืขืจืืืื ืงืึธื ืืขืงืกื, ืืืึธืก ืืืืขืจืืึทื ื ืืืึธืก ืืึธืืืืื ื ืืืจ ืงืขื ืขื ืืื ืงืขื ืขื ื ืืฉื ืคืึทืจืืื ืื.
- ืืึธืืืืื ื - ืืื SELinux, ืึท ืคืขืื ืืื ืืขืจ ืืืจืืคืืจืื ื ืงืึธื ืืขืงืกื ืคืื ืึท ืื ืืขืจืืขื ืืง, ื"ื ืึท ืคึผืจืึธืฆืขืก. ืื ืคืขืื ืืืืื ืืืืขืจืืึทื ื ืื ืึทืงืกืขืก ืึทื ืึท ืคึผืจืึธืฆืขืก ืืื. ื ืคืขืื ืืื ืืืืกืืงืื ืึท ืจืฉืืื ืคืื ืืืึธืก ืคึผืจืึทืกืขืกืึทื ืงืขื ืขื ืืึธื ืึธืืขืจ ืืืึธืก ืึท ืคึผืจืึธืฆืขืก ืงืขื ืขื ืืึธื ืืื ืคืึทืจืฉืืืขื ืข ืืืืคึผืก. ืขืืืขืืข ืืืืฉืคืืื ืคืื ืืึธืืืืื ื ืืขื ืขื sysadm_t ืคึฟืึทืจ ืกืืกืืขื ืึทืืืื ืืกืืจืึทืฆืืข, ืืื user_t ืืืึธืก ืืื ืึท ื ืึธืจืืึทื ื ืื-ืคึผืจืืืืืืืืฉื ืืึทื ืืฆืขืจ ืคืขืื. ืื init ืกืืกืืขื ืืืืคื ืืื ืื init_t ืคืขืื, ืืื ืื ืืขืืืืกื ืคึผืจืึธืฆืขืก ืืืืคื ืืื ืื named_t ืคืขืื.
- ืจืึธืืขืก - ืืืึธืก ืกืขืจืืืขืก ืืื ืึท ืื ืืขืจืืืืืขืจื ืฆืืืืฉื ืืึธืืืืื ื ืืื SELinux ืืืืขืจื. ืจืึธืืขืก ืืึทืฉืืืืขื ืฆื ืืืึธืก ืืึธืืืืื ื ืึท ืืึทื ืืฆืขืจ ืงืขื ืขื ืืขืืขืจื ืืื ืืืึธืก ืืืืคึผืก ืคืื ืึทืืืืฉืขืงืฅ ืืื ืงืขื ืขื ืึทืงืกืขืก. ืืขื ืึทืงืกืขืก ืงืึธื ืืจืึธื ืืขืงืึทื ืืืึทื ืคึผืจืืืืขื ืฅ ืื ืกืึทืงืึธื ืข ืคืื โโืคึผืจืืืืืืขืืืข ืขืกืงืึทืืืจืื ื ืื ืคืืื. ืจืึธืืขืก ืืขื ืขื ืืขืฉืจืืื ืืื ืื ืจืึธืืข-ืืึทืืืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื (RBAC) ืืืืขืจืืืื ืืึธืืขื ืืขื ืืฆื ืืื SELinux.
- ืืืืคึผืก - ื ืืืคึผ ืขื ืคืึธืจืกืืึทื ื ืจืฉืืื ืึทืืจืืืืื ืืืึธืก ืืื ืึทืกืืื ื ืฆื ืึท ืืืืคืขืฅ ืืื ืืืืขืจืืึทื ื ืืืขืจ ืงืขื ืขื ืึทืงืกืขืก ืขืก. ืขื ืืขื ืฆื ืื ืคืขืื ืืขืคึฟืื ืืฆืืข, ืึทืืืฅ ืึทื ืคืขืื ืึทืคึผืืืื ืฆื ืึท ืคึผืจืึธืฆืขืก, ืืื ืืืคึผ ืึทืคึผืืืื ืฆื ืึทืืืืฉืขืงืฅ ืึทืืึท ืืื ืืืจืขืงืืขืจืื, ืืขืงืขืก, ืกืึทืงืึทืฅ, ืขืืง.
- ืืขืืขืก ืืื ืึทืืืืฉืขืงืฅ - ืคึผืจืึทืกืขืกืึทื ืืขื ืขื ืกืึทืืืืฉืขืงืฅ ืืื ืืืืคื ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืงืึธื ืืขืงืกื ืึธืืขืจ ืืืืขืจืืืื ืคืขืื. ืึทืคึผืขืจืืืืื ื ืกืืกืืขื ืจืขืกืืจืกื: ืืขืงืขืก, ืืืืจืขืงืืขืจืื, ืกืึทืงืึทืฅ, ืืื"ื ื, ืืขื ืขื ืึทืืืืฉืขืงืฅ ืืืึธืก ืืขื ืขื ืึทืกืืื ื ืึท ืืืืขืจ ืืืคึผ, ืืื ืื ืืขืจืข ืืืขืจืืขืจ, ืึท ืคึผืจืืืืึทืืงืืื ืืืจืื.
- SELinux ืคึผืึทืืึทืกืื - SELinux ื ืืฆื ืึท ืคืึทืจืฉืืืื ืงืืึทื ืคืื ืคึผืึทืืึทืกืื ืฆื ืืึทืฉืืฆื ืื ืกืืกืืขื. ืื SELinux ืคึผืึธืืืืืง ืืืคืืื ื ืื ืึทืงืกืขืก ืคืื ื ืืฆืขืจืก ืฆื ืจืึธืืขืก, ืจืึธืืขืก ืฆื ืืึธืืืืื ื ืืื ืืึธืืืืื ื ืฆื ืืืืคึผืก. ืขืจืฉืืขืจ, ืืขืจ ืืึทื ืืฆืขืจ ืืื ืึธืืขืจืืืื ืฆื ืืึทืงืืืขื ืึท ืจืึธืืข, ืืื ืืขืจ ืจืึธืืข ืืื ืึธืืขืจืืืื ืฆื ืึทืงืกืขืก ืืึธืืืืื ื. ืฆืื ืกืืฃ, ืึท ืคืขืื ืงืขื ืขื ืืืืื ืืึธืื ืึทืงืกืขืก ืฆื ืืืืขืจ ืืืืคึผืก ืคืื ืึทืืืืฉืขืงืฅ.
LSM ืืื ืื SELinux ืึทืจืงืึทืืขืงืืฉืขืจ
ืืจืึธืฅ ืืขื ื ืึธืืขื, LSMs ืืขื ืขื ืืืื ื ืืฉื ืืึธืืืึทืืืข ืืื ืืงืก ืืึทืืืฉืืื. ืึธืืขืจ, ืืื SELinux, ืขืก ืืื ืืืืึทื ืื ืึทืืจืืืืื ืืื ืื ืงืขืจื. ืงืืื ืขื ืืขืจืื ื ืฆื ืื LSM ืืงืืจ ืงืึธื ืจืืงืืืืืขืจื ืึท ื ืืึทืข ืงืขืจื ืืึทืืืื ื. ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืึธืคึผืฆืืข ืืืื ืืืื ืขื ืืืืึทืื ืืื ืื ืงืขืจื ืกืขืืืื ืืก, ืึทื ืืขืจืฉ ืื LSM ืงืึธื ืืืขื ื ืืฉื ืืืื ืึทืงืืืืืืืืื ื ืึธื ืฉืืืืื. ืึธืืขืจ ืืคืืื ืืื ืืขื ืคืึทื, ืขืก ืงืขื ืขื ืืืื ืขื ืืืืึทืื ืืืจื ืื OS ืืึธืึธืืืึธืึทืืขืจ ืึธืคึผืฆืืข.
LSM ืืฉืขืง ืึธื ืืืืื
LSM ืืื ืืงืืืืคึผื ืืื ืืืงืก ืืื ืืึทืจืฅ ืงืขืจื ืคืึทื ืืงืฉืึทื ื ืืืึธืก ืงืขื ืขื ืืืื ืืึทืืืึทืืืง ืคึฟืึทืจ ืืฉืขืงืก. ืืืื ืขืจ ืคืื ืื ืืืืคึผื ืคึฟืขืึดืงืืืื ืคืื LSMs ืืื ืึทื ืืื ืืขื ืขื ืกืืึทืงื. ืืืื, ืื ื ืึธืจืืึทื ืืฉืขืงืก ืืขื ืขื ื ืึธื ืืืจืืืขืงืึธืื, ืืื ืืขืืขืจ ืฉืืืืข ืคืื โโโโืืกื ืืืืื ืืืกืืฃ ื ืึธื ืงืึธื ืืจืึธืืก ืืื ืงืึธื ืืจืึธืืก. ืืืก ืืืื ื ืื ืืขื ืงืขื ื ืืฉื ืฆืืจืืงืฆืืขื ืืขื ืืืกืืจ. ืืึธืก ืืื ืืขืืืืื ืืื ืื ืคืืืืจ; ืืืื ืืขืจ ืจืขืืืืืึทื ืคืื ืจืืืื DAC ืืฉืขืงืก ืืื ืึท ืืืจืืคืึทื, ืืขืจ ืขื ืื ืืืขื ื ืืฉื ืืคืืื ืืขืจืืจืืืื ืื LSM ืืืงืก.
SELinux ืึทืืึทืคึผืฅ ืื ืคืืึทืกืง ืืืืขืจืืืื ืึทืจืงืึทืืขืงืืฉืขืจ ืคืื ืื Fluke ืคืึธืจืฉืื ื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื, ืกืคึผืขืฆืืขื ืืขืจ ืคึผืจืื ืฆืืคึผ ืคืื ืืื ืืกืืขืจ ืคึผืจืืืืืืขืืืข. ืื ืขืกืึทื ืก ืคืื ืืขื ืืึทืืจืืฃ, ืืื ืืืื ื ืึธืืขื ืกืึทืืืืฉืขืก, ืืื ืฆื ืืขืื ืื ืืึทื ืืฆืขืจ ืึธืืขืจ ืคึผืจืึธืฆืขืก ืืืืื ืื ืจืขืื ืืืึธืก ืืขื ืขื ื ืืืืืง ืฆื ืืืจืืคืืจื ืื ืืืขื ืึทืงืฉืึทื ื. ืืขืจ ืคึผืจืื ืฆืืคึผ ืืื ืืืคึผืืึทืืขื ืึทื ืืื ืืขืฆืืืื ืืขื ืึทืงืกืขืก ืืืืคึผืื ื, ืึทืืื ืึทืงืกืขืก ืงืึธื ืืจืึธื ืืื SELinux ืืื ืืืืืจื ืืืืฃ ืื ืคืขืื => ืืืคึผ ืืึธืืขื.
ืืึทื ืง ืฆื ืืขืฆืืืื ืืขื ืึทืงืกืขืก ืืืืคึผืื ื, SELinux ืืื ืคืื ืืจืขืกืขืจืข ืึทืงืกืขืก ืงืึธื ืืจืึธื ืงืืืคึผืึทืืืืึทืืื ืืื ืื ืืจืืืืฆืืื ืขืื ืืึทืง ืืึธืืขื ืืขื ืืฆื ืืื ืืื ืืงืก / ืืื ืืงืก ืึธืคึผืขืจืืืืื ื ืกืืกืืขืืขื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจ ืงืขื ืขื ืืึทืืจืขื ืขืฆื ืื ื ืขืฅ ืคึผืึธืจื ื ืืืขืจ ืืืึธืก ืื ืคืืคึผ ืกืขืจืืืขืจ ืืืขื ืคืึทืจืืื ืื ืฆื, ืืึธืื ืฉืจืืืื ืืื ืืฉืึทื ืืื ื ืืขืงืขืก ืืื ืึท ืืืืขืจ ืืขืงืข, ืึธืืขืจ ื ืืฉื ืืืกืืขืงื ืืื.
ืื ืืืืคึผื ืงืึทืืคึผืึธืื ืึทื ืฅ ืคืื SELinux ืืขื ืขื:
- ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ - ืื ืืืืคึผื ืืขืงืึทื ืืืึทื ืคึฟืึทืจ ืึธืจืืึทื ืืืืื ื ืึทืงืกืขืก ืงืึธื ืืจืึธื.
- ืกืืกืืขื ืืืืขืจืืืื ืคึผืึธืืืืืง ืืึทืืึทืืืืก.
- ืื ืืขืจืึทืงืฉืึทื ืืื ืื LSM ืืขืฉืขืขื ืืฉ ืื ืืขืจืกืขืคึผืืึธืจ.
- Selinuxfs - ืคึผืกืขืืืืึธ-ืคืก, ืื ืืขืืืข ืืื / ืคึผืจืึธืง ืืื ืืึธืื ืืขื ืืื /sys/fs/selinux. ืืื ืึทืืืฉ ืคึผืึทืคึผืืึทืืืืืึทื ืืืจื ืื ืืื ืืงืก ืงืขืจื ืืื ืจืื ืืืืข ืืื ืืื ืืขืงืขืก ืืื SELinux ืกืืึทืืืก ืืื ืคึฟืึธืจืืึทืฆืืข.
- ืึทืงืกืขืก ืืืขืงืืึธืจ ืงืึทืฉ - ืึทื ืึทืืืืืืขืจื ืืขืงืึทื ืืืึทื ืคึฟืึทืจ ืื ืงืจืืกืื ื ืคึผืจืึธืืืึทืงืืืืืึทืื.
ืืื SELinux ืึทืจืืขื
ืขืก ืึทืืข ืึทืจืืขื ืืื ืืึธืก.
- ื ืืขืืืืกืข ืืขืืข, ืืื SELinux ืืขืจืืื ืขื, ืคึผืขืจืคืึธืจืื ืึท ืืขืจืืืืื ืงืึทืืฃ ืืืืฃ ืึท ืืืืคืขืฅ ื ืึธื ืึท DAC ืืฉืขืง, ืืื ืืขืืืืื ืืื ืื ืฉืคึผืืฅ ืืืื. ืื ืืงืฉื ืฆื ืืืจืืคืืจื ืึทื ืึธืคึผืขืจืึทืฆืืข ืืืื ืฆื ืื LSM ืืขืฉืขืขื ืืฉ ืื ืืขืจืกืขืคึผืืึธืจ.
- ืคึฟืื ืืึธืจื, ืื ืืงืฉื, ืฆืืืึทืืขื ืืื ืื ืงืึธื ืืขืงืกื ืคืื ืื ืื ืืขืจืืขื ืืง ืืื ืึทืืืืฉืขืงื ืืืืขืจืืืื, ืืื ืืืจืืืขืืื ืืขื ืฆื ืื SELinux ืึทืืกืืจืึทืงืืืึธื ืืื ืืึธืง ืืึธืืืง ืืึธืืืืข, ืืืึธืก ืืื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืื ืืขืจืึทืงืืื ื ืืื ืื LSM.
- ืื ืืึทืฉืืืก-ืืืื ืืืืืึธืจืืืขื ืืืืฃ ืื ืึทืงืกืขืก ืคืื ืึท ืื ืืขืจืืขื ืืง ืฆื ืึท ืืืืคืขืฅ ืืื ืื ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ ืืื ืขืก ื ืขืื ืืึทืื ืคืื SELinux AnHL.
- ืฆื ืืึทืื ืืืกืืืฉืึทื ื ืืืขืื ืึทืงืกืขืก ืึธืืขืจ ืึธืคึผืืืืงืขื ืื ื, ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ ืืืจื ืก ืฆื ืื ืึทืงืกืขืก ืืืขืงืืึธืจ ืงืึทืฉ (AVC) ืงืึทืืฉืื ื ืกืึทืืกืืกืืึทื ืคึฟืึทืจ ืื ืืขืจืกื ืืขืืืืื ื ืึผืืืื.
- ืืืื ืึท ืืืืืื ื ืคึฟืึทืจ ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืขืจืฉื ืืื ื ืืฉื ืืขืคึฟืื ืขื ืืื ืื ืงืึทืฉ, ืื ืืขืื ืืื ืืืจืืืขืืื ืืขื ืฆื ืื ืืืืขืจืืืื ืคึผืึธืืืืืง ืืึทืืึทืืืืก.
- ืืขืจ ืืืื ืจืขืืืืืึทื ืคืื ืื ืืึทืืึทืืืืก ืืื AVC ืืื ืืืืืขืงืขืจื ืฆื ืื ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืกืขืจืืืืจืขืจ.
- ืืืื ืื ืืขืคืื ืขื ืคึผืึธืืืืืง ืฉืืืขืืขืืขื ืื ืืขืืขืื ืงืึทืืฃ, ืื ืึธืคึผืขืจืึทืฆืืข ืืื ืขืจืืืืื. ืึทื ืืขืจืฉ, ืื ืึธืคึผืขืจืึทืฆืืข ืืื ืคึผืจืึธืืืืืึทืืึทื.
ืึธื ืคืืจืื ื SELinux ืกืขืืืื ืืก
SELinux ืึทืคึผืขืจืืืฅ ืืื ืืืื ืขืจ ืคืื ืืจืื ืืึธืืขืก:
- ืขื ืคืึธืจืกืื ื - ืฉืืจืขื ื ืึทืืืืจ ืฆื ืืืืขืจืืืื ืคึผืึทืืึทืกืื.
- ืคึผืขืจืืืกืืื - ืืืืขื ืคืื ืจืืกืืจืืงืฉืึทื ื ืืื ืขืจืืืืื; ืึท ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืึธื ืืื ืืขืืืื ืืื ืืขื ืืฉืืจื ืึทื.
- ืคืึทืจืงืจืืคึผืื - ืืืืขืจืืืื ืคึผืึทืืึทืกืื ืืขื ืขื ื ืืฉื ืืื ืืืืจืงืื ื.
ืืืจ ืงืขื ื ืืขื ืืื ืืืึธืก ืืึธืืข SELinux ืืื ืืื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื.
[admin@server ~]$ getenforce
Permissiveืืฉืึทื ืืื ื ืื ืืึธืืข ืืืืืขืจ ืจืืกืืึทืจืืื ื, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืึทืฉืืขืืืงื ืขืก ืฆื ืขื ืคืึธืจืกืื ื, ืึธืืขืจ 1. ืืขืจ ืคึผืขืจืืืกืืื ืคึผืึทืจืึทืืขืืขืจ ืงืึธืจืึทืกืคึผืึทื ืื ืฆื ืื ื ืืืขืจืืง ืงืึธื 0.
[admin@server ~]$ setenfoce enforcing
[admin@server ~]$ setenfoce 1 #ัะพ ะถะต ัะฐะผะพะต
ืืืจ ืงืขื ืขื ืืืื ืืืืฉื ืื ืืึธืืข ืืืจื ืขืืืืื ื ืื ืืขืงืข:
[admin@server ~]$ cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE = ืฆืื
ืืขืจ ืืืืืง ืืื setenfoce ืืื ืึทื ืืืขื ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื ืฉืื, ืื SELinux ืืึธืืข ืืืขื ืืืื ืืึทืฉืืืื ืืื ืืืื ืืื ืื ืืืขืจื ืคืื ืื SELINUX ืคึผืึทืจืึทืืขืืขืจ ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข. ืืื ืึทืืืฉืึทื, ืขื ืืขืจืื ืืขื ืฆื ืขื ืคืึธืจืกืื ื <=> ืคืึทืจืงืจืืคึผืื ื ืขืืขื ืืืืจืงืื ื ืืืืื ืืืจื ืขืืืืื ื ืื /etc/selinux/config ืืขืงืข ืืื ื ืึธื ืึท ืจืขืืึธืึธื.
ืืขื ืึท ืงืืจืฅ ืกืืึทืืืก ืืึทืจืืื:
[admin@server ~]$ sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 31
ืฆื ืืขื SELinux ืึทืืจืืืืืฅ, ืขืืืขืืข ื ืึธืจืืึทื ืืืืืืึทืืื ื ืืฆื ืื -Z ืคึผืึทืจืึทืืขืืขืจ.
[admin@server ~]$ ls -lZ /var/log/httpd/
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20200920
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20200927
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20201004
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access_log-20201011
[admin@server ~]$ ps -u apache -Z
LABEL PID TTY TIME CMD
system_u:system_r:httpd_t:s0 2914 ? 00:00:04 httpd
system_u:system_r:httpd_t:s0 2915 ? 00:00:00 httpd
system_u:system_r:httpd_t:s0 2916 ? 00:00:00 httpd
system_u:system_r:httpd_t:s0 2917 ? 00:00:00 httpd
...
system_u:system_r:httpd_t:s0 2918 ? 00:00:00 httpdืงืึทืืคึผืขืจื ืืื ืืขืจ ื ืึธืจืืึทื ืจืขืืืืืึทื ืคืื ls -l, ืขืก ืืขื ืขื ืขืืืขืืข ื ืึธื ืคืขืืืขืจ ืืื ืื ืคืืืืขื ืืข ืคึฟืึธืจืืึทื:
<user>:<role>:<type>:<level>
ืื ืืขืฆืืข ืคืขืื ืืื ืึธืืฅ ืขืคึผืขืก ืืื ืึท ืืืืขืจืืืื ืงืืึทืกืึทืคืึทืงืืืฉืึทื ืืื ืืืฉืืืื ืคืื ืึท ืงืึธืืืื ืึทืฆืืข ืคืื โโโโืฆืืืื ืขืืขืืขื ืื:
- s0 - ืืึทืืืึทื, ืืืื ืืขืฉืจืืื ืืื ื ืืืขืจืืง-ืืืื ืืขืืึทืืขื
- c0, c1โฆ c1023 - ืงืึทืืขืืึธืจืืข.
ืืฉืึทื ืืื ื ืึทืงืกืขืก ืงืึทื ืคืืืืขืจืืืฉืึทื
ื ืืฆื ืกืขืืึธืืืืข ืฆื ืืึธืื, ืืืืื ืืื ืืึทืืืึทืืืงื SELinux ืืึทืืืฉืืื.
[admin@server ~]$ semodule -l |wc -l #ัะฟะธัะพะบ ะฒัะตั
ะผะพะดัะปะตะน
408
[admin@server ~]$ semodule -e abrt #enable - ะฐะบัะธะฒะธัะพะฒะฐัั ะผะพะดัะปั
[admin@server ~]$ semodule -d accountsd #disable - ะพัะบะปััะธัั ะผะพะดัะปั
[admin@server ~]$ semodule -r avahi #remove - ัะดะฐะปะธัั ะผะพะดัะปัืขืจืฉืืขืจ ืืึทื ืฉืึทืคึฟื ืืึธืืื ืืึธืืื ืงืึทื ืขืงืฅ ืื SELinux ืืึทื ืืฆืขืจ ืฆื ืื ืึทืคึผืขืจืืืืื ื ืกืืกืืขื ืืึทื ืืฆืขืจ, ืื ืจืืข ืืืกืคึผืืืื ืึท ืจืฉืืื. ืฆืื ืกืืฃ, ืื ืืขืฆืืข ืืึทืคึฟืขื ืืื ืื -r ืืึทืฉืืืืขื ืจืืืืืื ืื ืืึทืคึผืื ื ืคืื SELinux ืืืืขืจื ืฆื ืึทืก ืึทืงืึทืื ืฅ. ื ืืขืจืงืืขืจืื ื ืคืื ืื ืกืื ืืึทืงืก ืคึฟืึทืจ MLS / MCS ืงืืื ืืืึทืืืขืก ืืื ืืื ืื ืคืจืืขืจืืืงืข ืึธืคึผืืืืืื ื.
[admin@server ~]$ semanage login -a -s user_u karol
[admin@server ~]$ semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
system_u system_u s0-s0:c0.c1023 *
[admin@server ~]$ semanage login -d karol
ืงืึธืืขืงืืืื ืกืขืืึทื ืึทืืข ืืึทื ืืฆืขืจ ืืขืืืืื ื ืฆื ืคืืจื ืืึทืคึผืื ืื ืฆืืืืฉื SELinux ื ืืฆืขืจืก ืืื ืจืึธืืขืก.
[admin@server ~]$ semanage user -l
Labeling MLS/ MLS/
SELinux User Prefix MCS Level MCS Range SELinux Roles
guest_u user s0 s0 guest_r
staff_u staff s0 s0-s0:c0.c1023 staff_r sysadm_r
...
user_u user s0 s0 user_r
xguest_u user s0 s0 xguest_r
[admin@server ~]$ semanage user -a -R 'staff_r user_r'
[admin@server ~]$ semanage user -d test_uืืึทืคึฟืขืื ืคึผืึทืจืึทืืขืืขืจืก:
- - ืึท ืืืืื ืื ืื ืจืึธืืข ืืึทืคึผืื ื ืคึผืึธืืืฆืืข;
- -ื ืจืฉืืื ืคืื ืืืึธืก ืจืืืื ื ืืฆืขืจืก ืืื ืจืึธืืขืก;
- -ื ืืืกืืขืงื ืืึทื ืืฆืขืจ ืจืึธืืข ืืึทืคึผืื ื ืคึผืึธืืืฆืืข;
- -ืจ ืจืฉืืื ืคืื ืจืึธืืขืก ืึทืืึทืืฉื ืฆื ืืขืจ ืืึทื ืืฆืขืจ;
ืืขืงืขืก, ืคึผืึธืจืฅ ืืื ืืืืืึทื ืืืึทืืืขืก
ืืขืืขืจ SELinux ืืึธืืืืข ืืื ืึท ืืึทื ื ืคืื ืืขืงืข ืืึทืืื ื ืึผืืืื, ืึธืืขืจ ืืืจ ืงืขื ืขื ืืืื ืืืืื ืืืื ืืืืืขื ืข ืึผืืืื ืืืื ื ืืืืืง. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจ ืืืขืื ืื ืืืขื ืกืขืจืืืขืจ ืฆื ืืึธืื ืึทืงืกืขืก ืจืขืื ืฆื ืื / srv/www ืืขืงืข.
[admin@server ~]$ semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?
[admin@server ~]$ restorecon -R /srv/www/ืืขืจ ืขืจืฉืืขืจ ืืึทืคึฟืขื ืจืขืืืฉืืกืืขืจื ื ืืึท ืืึทืจืงืื ื ืึผืืืื, ืืื ืื ืจืืข ืจืืกืขืฅ, ืึธืืขืจ ืืึทื ืฅ ืฉืืขืื, ืื ืืขืงืข ืืืืคึผืก ืืื ืืืื ืืื ืื ืงืจืึทื ื ืึผืืืื.
ืคึผืื ืงื ืึทืืื, TCP / UDP ืคึผืึธืจืฅ ืืขื ืขื ืื ืืขืฆืืืื ื ืืื ืึทืืึท ืึท ืืืขื ืึทื ืืืืื ืื ืฆืื ืขืืขื ืืึทืืื ืื ืืก ืงืขื ืขื ืืขืจื ืืืืฃ ืืื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืื ืกืืจ ืคึฟืึทืจ ืื ืืืขื ืกืขืจืืืขืจ ืฆื ืืขืจื ืืืืฃ ืคึผืึธืจื 8080, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืคื ืื ืืึทืคึฟืขื.
[admin@server ~]$ semanage port -m -t http_port_t -p tcp 8080ื ืืึทืืืืืืง ื ืืืขืจ ืคืื SELinux ืืึทืืืฉืืื ืืึธืื ืคึผืึทืจืึทืืขืืขืจืก ืืืึธืก ืงืขื ืขื ื ืขืืขื ืืึธืึธืืขืึทื ืืืึทืืืขืก. ืื ืืื ืฆืข ืจืฉืืื ืคืื ืึทืืึท ืคึผืึทืจืึทืืขืืขืจืก ืงืขื ืขื ืืืื ืืขืืขื ืืื getsebool -a. ืืืจ ืงืขื ืขื ืืืืฉื ืืืืืึทื ืืืึทืืืขืก ื ืืฆื setsebool.
[admin@server ~]$ getsebool httpd_enable_cgi
httpd_enable_cgi --> on
[admin@server ~]$ setsebool -P httpd_enable_cgi off
[admin@server ~]$ getsebool httpd_enable_cgi
httpd_enable_homedirs --> off
ืืืึทืจืฉืืึทื, ืืึทืงืืืขื ืึทืงืกืขืก ืฆื ืื Pgadmin-ืืืขื ืฆืืืื ื
ืืึธืืืจ ืืขื ืึท ืคึผืจืึทืงืืืฉ ืืืึทืฉืคึผืื: ืืืจ ืืื ืกืืึทืืืจื pgadmin7.6-web ืืืืฃ RHEL 4 ืฆื ืคืืจื ืื PostgreSQL ืืึทืืึทืืืืก. ืื ืจ ืืฒื ืข ื ืืขืืื ืืข ื ื ืืืกื ืืื ืื ืกืขืืืื ืืก ืคืื pg_hba.conf, postgresql.conf ืืื config_local.py, ืฉืืขืื ืืขืงืข ืคึผืขืจืืืฉืึทื ื, ืืื ืกืืึทืืืจื ืื ืคืขืื ืืืง ืคึผืืืืึธื ืืึทืืืฉืืื ืคึฟืื ืคึผืืคึผ. ืึทืืฅ ืืื ืืจืืื, ืืืจ ืงืึทืืขืจ ืืื ืืึทืงืืืขื 500 ืืื ืขืจืืขืืขืจ ืกืขืจืืืืจืขืจ ืืขืืช.
ืืืจ ืึธื ืืืืื ืืื ืื ืืืคึผืืฉ ืกืึทืกืคึผืขืงืฅ, ืืฉืขืง /var/log/httpd/error_log. ืขืก ืืขื ืขื ืขืืืขืืข ืืฉืืงืึทืืืข ืืืื ืกื ืืึธืจื.
[timestamp] [core:notice] [pid 23689] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
...
[timestamp] [wsgi:error] [pid 23690] [Errno 13] Permission denied: '/var/lib/pgadmin'
[timestamp] [wsgi:error] [pid 23690]
[timestamp] [wsgi:error] [pid 23690] HINT : You may need to manually set the permissions on
[timestamp] [wsgi:error] [pid 23690] /var/lib/pgadmin to allow apache to write to it.
ืืื ืืขื ืคืื ื, ืจืืึฟ ืืื ืืงืก ืึทืืืื ืืกืืจืึทืืึธืจืก ืืืขื ืืืื ืฉืืืจืง ืืขืคืจืืืืื ืฆื ืืืืคื setencorce 0, ืืื ืืึธืก ืืืขื ืืืื ืืขืจ ืกืืฃ ืคืื ืขืก. ืคืจืึทื ืืงืื, ืืื ืืึธื ืคึผืื ืงื ืืึธืก ืืขืจ ืขืจืฉืืขืจ ืืึธื. ืืึธืก ืืื ืืึธื ืืืื ืึท ืืืืกืืืขื, ืึธืืขืจ ืืืืื ืคืื ืืขืจ ืืขืกืืขืจ.
ืืจืึธืฅ ืื ืงืึทืืืขืจืกืึทื ืืืืืื ื, SELinux ืงืขื ืขื ืืืื ืืึทื ืืฆืขืจ-ืคืจืืึทื ืืืขื. ื ืึธืจ ืื ืกืืึทืืืจื ืื ืกืขืืจืึธืืืขืฉืึธืึธื ืคึผืขืงื ืืื ืืขื ืื ืกืืกืืขื ืงืืึธืฅ.
[admin@server ~]$ yum install setroubleshoot
[admin@server ~]$ journalctl -b -0
[admin@server ~]$ service restart auditd
ืืืืข ืืึธื ืึทื ืื ืึทืืืื ืกืขืจืืืืก ืืืื ืืืื ืจืืกืืึทืจืืื ืืขื ืืืขื, ืืื ื ืืฉื ื ืืฆื ืกืืกืืขืืงืื, ืืจืึธืฅ ืืขื ืืืึทืืืึทื ืคืื ืกืืกืืขื ืืื ืื ืึทืก. ืืื ืื ืกืืกืืขื ืงืืึธืฅ ืืืขื ืืืื ืื ืืขืืืืื ื ืื ืืืืื ืื ืคืึทืงื ืคืื ืืืึทืงืื ื, ืึธืืขืจ ืืืื ืื ืกืืื ืืื ืืืขื ืฆื ืืึทืงืืืขื ืืขื ืคืึทืจืืึธื.
ืืืจ ืืืกืคืืจื ืื ืงืึทืืึทื ืื:
[admin@server ~]$ setsebool -P httpd_can_network_connect 1
[admin@server ~]$ setsebool -P httpd_can_network_connect_db 1
ืืืจ ืงืึธื ืืจืึธืืืจื ืึทืงืกืขืก ืฆื ืื pgadmin4-ืืืขื ืืืึทื, ืึทืืฅ ืึทืจืืขื.
ืืงืืจ: www.habr.com