|
1 2 |
[root@localhost ~]# uname -a Linux localhost.localdomain 3.11.10-301.fc20.x86_64 #1 SMP Thu Dec 5 14:01:17 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux |
|
1 2 |
[root@localhost ~]# id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 |
查看当前规则库的主要信息：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
[root@localhost ~]# seinfo Statistics for policy file: /sys/fs/selinux/policy Policy Version & Type: v.28 (binary, mls) Classes: 83 Permissions: 255 Sensitivities: 1 Categories: 1024 Types: 4285 Attributes: 349 Users: 8 Roles: 14 Booleans: 265 Cond. Expr.: 318 Allow: 93097 Neverallow: 0 Auditallow: 120 Dontaudit: 7685 Type_trans: 14773 Type_change: 74 Type_member: 27 Role allow: 29 Role_trans: 738 Range_trans: 5006 Constraints: 98 Validatetrans: 0 Initial SIDs: 27 Fs_use: 26 Genfscon: 91 Portcon: 528 Netifcon: 0 Nodecon: 0 Permissives: 7 Polcap: 2 |
查看policy定义的所有selinux用户
|
1 2 3 4 5 6 7 8 9 10 11 |
[root@localhost ~]# seinfo --user Users: 8 sysadm_u system_u xguest_u root guest_u staff_u user_u unconfined_u |
查看system_u 用户的角色及mls range
|
1 2 3 4 5 6 7 8 |
[root@localhost ~]# seinfo --user=system_u -x system_u default level: s0 range: s0 - s0:c0.c1023 roles: object_r system_r unconfined_r |
查看selinux的manager
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
[root@localhost ~]# semanage user -l 标记中 MLS/ MLS/ SELinux 用户 前缀 MCS 级别 MCS 范围 SELinux 角色 guest_u user s0 s0 guest_r root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r sysadm_u user s0 s0-s0:c0.c1023 sysadm_r system_u user s0 s0-s0:c0.c1023 system_r unconfined_r unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r user_u user s0 s0 user_r xguest_u user s0 s0 xguest_r |
查看按照pp的条目
|
1 2 |
[root@localhost ~]# semodule -l |wc -l 363 |
查看seliunxfs伪文件系统标签。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
[root@localhost fs]# seinfo --genfscon=selinuxfs genfscon selinuxfs / system_u:object_r:security_t:s0 [root@localhost fs]# ll -Z selinux/ -rw-rw-rw-. root root system_u:object_r:security_t:s0 access dr-xr-xr-x. root root system_u:object_r:security_t:s0 avc dr-xr-xr-x. root root system_u:object_r:security_t:s0 booleans -rw-r--r--. root root system_u:object_r:security_t:s0 checkreqprot dr-xr-xr-x. root root system_u:object_r:security_t:s0 class --w-------. root root system_u:object_r:security_t:s0 commit_pending_bools -rw-rw-rw-. root root system_u:object_r:security_t:s0 context -rw-rw-rw-. root root system_u:object_r:security_t:s0 create -r--r--r--. root root system_u:object_r:security_t:s0 deny_unknown --w-------. root root system_u:object_r:security_t:s0 disable -rw-r--r--. root root system_u:object_r:security_t:s0 enforce dr-xr-xr-x. root root system_u:object_r:security_t:s0 initial_contexts -rw-------. root root system_u:object_r:security_t:s0 load -rw-rw-rw-. root root system_u:object_r:security_t:s0 member -r--r--r--. root root system_u:object_r:security_t:s0 mls crw-rw-rw-. root root system_u:object_r:null_device_t:s0 null -r--r--r--. root root system_u:object_r:security_t:s0 policy dr-xr-xr-x. root root system_u:object_r:security_t:s0 policy_capabilities -r--r--r--. root root system_u:object_r:security_t:s0 policyvers -r--r--r--. root root system_u:object_r:security_t:s0 reject_unknown -rw-rw-rw-. root root system_u:object_r:security_t:s0 relabel -r--r--r--. root root system_u:object_r:security_t:s0 status -rw-rw-rw-. root root system_u:object_r:security_t:s0 user |
查看selinux安全上下文对应的sid
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
[root@localhost fs]# seinfo --initialsid -x Initial SID: 27 devnull: system_u:object_r:null_device_t:s0 scmp_packet: system_u:object_r:unlabeled_t:s0 policy: system_u:object_r:unlabeled_t:s0 kmod: system_u:object_r:unlabeled_t:s0 sysctl_dev: system_u:object_r:unlabeled_t:s0 sysctl_vm: system_u:object_r:unlabeled_t:s0 sysctl_net_unix: system_u:object_r:unlabeled_t:s0 sysctl_net: system_u:object_r:unlabeled_t:s0 sysctl_kernel: system_u:object_r:unlabeled_t:s0 sysctl_fs: system_u:object_r:unlabeled_t:s0 sysctl: system_u:object_r:sysctl_t:s0 sysctl_modprobe: system_u:object_r:unlabeled_t:s0 tcp_socket: system_u:object_r:unlabeled_t:s0 icmp_socket: system_u:object_r:unlabeled_t:s0 igmp_packet: system_u:object_r:unlabeled_t:s0 node: system_u:object_r:node_t:s0 netmsg: system_u:object_r:netlabel_peer_t:s0 netif: system_u:object_r:netif_t:s0 port: system_u:object_r:port_t:s0 any_socket: system_u:object_r:unlabeled_t:s0 init: system_u:object_r:unlabeled_t:s0 file_labels: system_u:object_r:unlabeled_t:s0 file: system_u:object_r:file_t:s0 fs: system_u:object_r:fs_t:s0 unlabeled: system_u:object_r:unlabeled_t:s0 security: system_u:object_r:security_t:s0 kernel: system_u:system_r:kernel_t:s0 |