semanage

ماذا يفعل

طريقة الكتابة

semanage fcontext -a|-d|-m -t TYPE [-f FTYPE] "PATH-REGEX"
semanage port -a|-d|-m -t TYPE -p tcp|udp PORT[-PORT]
semanage boolean -l | -m --on|--off BOOLEAN
semanage permissive -a|-d|-l TYPE
semanage SUBCOMMAND -l [-C] | -E | -D

الأجزاء الرئيسية

fcontext

File context rules (paths → types).

port

Port types.

boolean

Booleans (with descriptions).

permissive

Permissive process types.

login

Linux users → SELinux users.

user

SELinux users (roles, levels).

module

Policy modules (list, enable, disable, remove).

interface, node, ibpkey, ibendport

Network interface, node and InfiniBand types.

dontaudit

Turn dontaudit rules off or on (to see hidden denials).

import, export

Save / load all local changes (copy to other servers).

الأكثر استخدامًا

لا يوجد شيء يطابق هذا الفلتر.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1. 1Label a new web folder

   #semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
   #restorecon -Rv /srv/web

   The regex covers the folder and everything below it.

2. 2Same labels as a known folder

   #semanage fcontext -a -e /var/www /srv/www

   /srv/www gets the labels of /var/www.

3. 3List your own file rules

   #semanage fcontext -l -C

   Only local changes.

4. 4Find the rule for a path

   #semanage fcontext -l | grep '^/var/www'

   Which types the policy gives there.

5. 5Allow a new port

   #semanage port -a -t http_port_t -p tcp 82

   Apache may now listen on 82.

6. 6Port already used by another type

   #semanage port -m -t http_port_t -p tcp 8080

   -m moves it (8080 is http_cache_port_t by default).

7. 7Show port types

   #semanage port -l | grep -w ssh_port_t
   ssh_port_t                     tcp      22, 2222

   Which ports sshd may use.

8. 8Booleans with descriptions

   #semanage boolean -l | grep httpd_can_network

   Current state, default, and what it does.

9. 9Make one domain permissive

   #semanage permissive -a httpd_t
   #semanage permissive -d httpd_t

   Debug one service; the rest stays enforcing.

10. 10Copy local changes to another server

    #semanage export > /root/selinux-local.txt
    #semanage import < /root/selinux-local.txt

    Same rules on all web servers.

11. 11See hidden denials

    #semanage dontaudit off

    Shows denials that are normally not logged; turn it on again after debugging.

لا يوجد شيء يطابق هذا الفلتر.

رموز الخروج