


How to view policy rules in SELinux: 1. Use the seinfo command to query how many relevant rules the SELinux policy provides. Whether a subject process can read the target file resources focuses on the SELinux policy and the contents within the policy. For each rule, the syntax is "seinfo [option]"; 2. Use the sesearch command to query the specific content of SELinux policy rules, the syntax is "sesearch [option] [rule type] [expression]".
#The operating environment of this tutorial: linux7.3 system, Dell G3 computer.
There are two ways to view SELinux policy rules: seinfo and sesearch.
The current default policy of SELinux is targeted, so how many rules does this policy contain? Use the seinfo
command to query.
seinfo command is used to query how many relevant rules the SELinux policy provides. Whether a subject process can read the target file resources focuses on the SELinux policy and the various items in the policy. Rule, and then use the definition of this rule to process the security context of each target file, especially the "type" part.
sesearch command format is as follows:
seinfo [选项]
Common options:
-a | List SELinux status and rules Boolean values, identification, roles, types and other information |
-t | List the types of all SELinux types |
-r | List all SELinux role types |
-u | List all SELinux identities (user ) |
-b | List the types of all rules (Boolean value) |
Reference example:
[root@localhost ~]# seinfo -b #还记得-b选项吗?就是查询布尔值,也就是查询规则名字 Conditional Booleans:187 #当前系统中有187个规则 allow_domain_fd_use allow_ftpd_full_access allow_sysadm_exec_content allow_user_exec_content allow_zebra_write_config …省略部分输出…
seinfo
The command can only see the names of all rules. If you want to know the specific content of the rules, you need to use the sesearch
command .
sesearch command format is as follows:
sesearch [选项] [规则类型] [表达式]
Options:
-h: Display help information;
Rule type:
--allow: Display allowed rules;
--neverallow: Display never-allowed rules;
--all: Display all rules;
Expression:
-s Subject type : Display the rules related to the type of the specified subject (the subject is the initiator of the access, this s means source, that is, the source type);
-t Target type: Display and Specify the rules related to the type of target (the target is the visitor, this t means target, that is, the target type);
#-b Rule name: Display the specific content of the rule ( b is bool, which means Boolean value, here refers to the rule name);
Here are a few examples. First, let's demonstrate how to query the specific rule content if we know the name of the rule. The command is as follows:
[root@localhost ~]# seinfo -b | grep http httpd_manage_ipa …省略部分输出… #查询和apache相关的规则,有httpd_manage_ipa规则 [root@localhost ~]# sesearch --all -b httpd_manage_ipa # httpd_manage_ipa规则中具体定义了哪些规则内容呢?使用sesearch命令查询一下 Found 4 semantic av rules: allow httpd_t var_run_t:dir { getattr search open } ; allow httpd_t memcached_var_run_t:file { ioctl read write create getattr setattr lock append unlink link rename open } ; allow httpd_t memcached_var_run_t:dir { ioctl read write getattr lock add_name remove_name search open } ; allow httpd_t var_t:dir { getattr search open } ; Found 20 role allow rules: allow system_r sysadm_r; allow sysadm_r system_r; …省略部分输出…
Each rule defines a large number of specific rule contents. These contents are relatively complex and generally do not need to be modified. Just be able to query them.
But sometimes what we know is the type of security context, not the name of the rule. For example, we know that the domain of the apache process is httpd_t, and the type of the /var/www/html/ directory is httpd_sys_content_t. The reason why apache can access the /var/www/html/ directory is because the httpd_t domain and httpd_sys_content_t type match.
So, how to query the matching rules of these two types? The command is as follows:
[root@localhost ~]# ps auxZ | grep httpd unconfined_u:system_r:httpd_t:s0 root 25620 0.0 0.5 11188 36X6 ? Ss 03:44 0:03 /usr/sbin/httpd #apache进程的域是httpd_t [root@localhost ~]# ls -Zd /var/www/html/ drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/ #/var/www/html/ 目录的类型是 httpd_sys_content_t [root@localhost ~]# sesearch --all -s httpd_t -t httpd_sys_content_t Found 13 semantic av rules: ...省略部分输出... allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock open }; allow httpd_t httpd_sys_content_t : dir { ioctl read getattr lock search open }; allow httpd_t httpd_sys_content_t : lnk_file { read getattr }; allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock open }; ...省略部分输出... #可以清楚地看到httpd_t域是允许访间和使用httpd_sys_content_t类型的
Related recommendations: "Linux Video Tutorial"
The above is the detailed content of What are the methods to view policy rules in SELinux?. For more information, please follow other related articles on the PHP Chinese website!

MaintenanceModeinLinuxisaspecialbootenvironmentforcriticalsystemmaintenancetasks.Itallowsadministratorstoperformtaskslikeresettingpasswords,repairingfilesystems,andrecoveringfrombootfailuresinaminimalenvironment.ToenterMaintenanceMode,interrupttheboo

The core components of Linux include kernel, file system, shell, user and kernel space, device drivers, and performance optimization and best practices. 1) The kernel is the core of the system, managing hardware, memory and processes. 2) The file system organizes data and supports multiple types such as ext4, Btrfs and XFS. 3) Shell is the command center for users to interact with the system and supports scripting. 4) Separate user space from kernel space to ensure system stability. 5) The device driver connects the hardware to the operating system. 6) Performance optimization includes tuning system configuration and following best practices.

The five basic components of the Linux system are: 1. Kernel, 2. System library, 3. System utilities, 4. Graphical user interface, 5. Applications. The kernel manages hardware resources, the system library provides precompiled functions, system utilities are used for system management, the GUI provides visual interaction, and applications use these components to implement functions.

Linux maintenance mode can be entered through the GRUB menu. The specific steps are: 1) Select the kernel in the GRUB menu and press 'e' to edit, 2) Add 'single' or '1' at the end of the 'linux' line, 3) Press Ctrl X to start. Maintenance mode provides a secure environment for tasks such as system repair, password reset and system upgrade.

The steps to enter Linux recovery mode are: 1. Restart the system and press the specific key to enter the GRUB menu; 2. Select the option with (recoverymode); 3. Select the operation in the recovery mode menu, such as fsck or root. Recovery mode allows you to start the system in single-user mode, perform file system checks and repairs, edit configuration files, and other operations to help solve system problems.

The core components of Linux include the kernel, file system, shell and common tools. 1. The kernel manages hardware resources and provides basic services. 2. The file system organizes and stores data. 3. Shell is the interface for users to interact with the system. 4. Common tools help complete daily tasks.

The basic structure of Linux includes the kernel, file system, and shell. 1) Kernel management hardware resources and use uname-r to view the version. 2) The EXT4 file system supports large files and logs and is created using mkfs.ext4. 3) Shell provides command line interaction such as Bash, and lists files using ls-l.

The key steps in Linux system management and maintenance include: 1) Master the basic knowledge, such as file system structure and user management; 2) Carry out system monitoring and resource management, use top, htop and other tools; 3) Use system logs to troubleshoot, use journalctl and other tools; 4) Write automated scripts and task scheduling, use cron tools; 5) implement security management and protection, configure firewalls through iptables; 6) Carry out performance optimization and best practices, adjust kernel parameters and develop good habits.


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

DVWA
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software

VSCode Windows 64-bit Download
A free and powerful IDE editor launched by Microsoft

SublimeText3 Mac version
God-level code editing software (SublimeText3)

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

Dreamweaver Mac version
Visual web development tools