selinux 010

SE리눅스 상태를 알아 본다.
root@cooler-desktop:~# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 24
Policy from config file:        ubuntu

1 1 첫번째는 현재 상태 1(true), 두번째는 펜딩 상태. 커밋이 되면 현재 상태에 적용될 것.
cat allow_execmod
1 1root@cooler-desktop:/selinux/booleans#

요런 sebool 값들이 있다.
root@cooler-desktop:/selinux/booleans# ls
allow_execheap            allow_user_postgresql_connect  nfs_export_all_rw       user_dmesg
allow_execmem             allow_write_xshm               secure_mode             user_ping
allow_execmod             allow_ypbind                   secure_mode_insmod      user_rw_noexattrfile
allow_execstack           cron_can_relabel               secure_mode_policyload  user_tcp_server
allow_mount_anyfile       fcron_crond                    ssh_sysadm_login        user_ttyfile_stat
allow_polyinstantiation   global_ssp                     use_lpd_server          xdm_sysadm_login
allow_ptrace              init_upstart                   use_nfs_home_dirs       xserver_object_manager
allow_ssh_keysign         mail_read_content              use_samba_home_dirs
allow_user_mysql_connect  nfs_export_all_ro              user_direct_mouse

명령어 사용법
root@cooler-desktop:/selinux/booleans# getsebool global_ssp
global_ssp --> off

root@cooler-desktop:/selinux/booleans# setsebool global_ssp 1
root@cooler-desktop:/selinux/booleans# !get
getsebool global_ssp
global_ssp --> on

요렇게 on/off 가능함.
1 1root@cooler-desktop:/selinux/booleans# echo 0 > global_ssp
root@cooler-desktop:/selinux/booleans# !cat
cat global_ssp
1 0root@cooler-desktop:/selinux/booleans# cat global_ssp
요러게 펜딩 값을 세팅 가능함. 커밋하면 적용되는데

커밋은
root@cooler-desktop:/selinux# ls -al commit_pending_bools
--w-------. 1 root root 0 Jan 27 16:57 commit_pending_bools
요놈이 한다.

root@cooler-desktop:/selinux# getsebool global_ssp
global_ssp --> on
root@cooler-desktop:/selinux# cat booleans/global_ssp
1 1root@cooler-desktop:/selinux# echo 0 > booleans/global_ssp
root@cooler-desktop:/selinux# cat booleans/global_ssp
1 0root@cooler-desktop:/selinux# echo 1 > commit_pending_bools
root@cooler-desktop:/selinux# cat booleans/global_ssp
0 0root@cooler-desktop:/selinux#
요렇게 commit에다가 1써주면 된다.



TIP

정책 빨리 찾기

find.te에다가 찾을 정책을 넣고 공백이랑 ==== xxxx ===를 지운다.
그리고 뒤에 붙는 permission부분 {}을 지우고 다음을 실행...


cat find.te | while read line; do grep -Risn "$line" * ; done