Familiar with the three working modes of SELinux

SELinux (Security-Enhanced Linux) is a security module that implements Mandatory Access Control (MAC) in Linux systems. It enforces security policies by applying labels to system objects (files, processes, etc.) for more fine-grained access control. SELinux has three working modes: Enforcing, Permissive and Disabled. This article will introduce these three modes in detail and provide specific code examples.

1. Enforcing mode

Enforcing mode is the safest and recommended mode, which enforces SELinux policies and denies and logs violations. In Enforcing mode, the system denies unauthorized access and generates corresponding log records. To understand Enforcing mode, we can go through the following code example to demonstrate how to set the SELinux label of a file and try to access it:

# 创建测试文件
touch testfile

# 查看文件的SELinux标签
ls -Z testfile

# 修改文件的SELinux标签为httpd_sys_content_t类型
chcon -t httpd_sys_content_t testfile

# 尝试访问文件
cat testfile

In the above example, we created a file named testfile and SELinux it The label is set to type httpd_sys_content_t. Attempting to read this file will result in access being denied because the file's label does not match the current process's label.

2. Permissive mode

Permissive mode allows system administrators to test SELinux policies without actually intercepting any access requests. In Permissive mode, SELinux will log access violations but will not deny them. This mode is typically used for debugging and testing new SELinux policies. The following is an example that demonstrates how to view log records in Permissive mode:

# 查看当前SELinux模式
sestatus

# 切换SELinux模式为Permissive
setenforce 0

# 尝试访问被禁止的文件
cat /etc/shadow

# 查看SELinux日志记录
cat /var/log/audit/audit.log

In the above example, we switch the SELinux mode to Permissive and try to read the /etc/shadow file, at which point the log records will Displays information about blocked access, but actual access is still allowed.

3. Disabled mode

Disabled mode will completely disable SELinux and cancel any access control and protection measures related to SELinux. This is the least recommended mode as the security of the system will be affected. In Disabled mode, the system will not execute SELinux policies and will not record any illegal access. The following is an example demonstrating how to disable SELinux:

# 查看当前SELinux模式
sestatus

# 禁用SELinux
setenforce 0

# 查看当前SELinux模式
sestatus

In the above example, we disabled SELinux through the setenforce command and verified that SELinux is in Disabled mode through the sestatus command.

Summary: Understanding the three working modes of SELinux is crucial for system security and access control. Enforcing mode provides the highest level of protection, Permissive mode is used for debugging and testing, and Disabled mode should be avoided to ensure system security. Through the above specific code examples, I hope readers can have a deeper understanding of the working mode of SELinux and its advantages and disadvantages.

The above is the detailed content of Familiar with the three working modes of SELinux. For more information, please follow other related articles on the PHP Chinese website!