Linux基础：通过setools-console查看SELinux信息

我就是我 2022-11-29 13:30 159阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpdW1pYW9jbg_size_16_color_FFFFFF_t_70_pic_center_pic_center]  
这篇文章介绍一下setools-console中包含的常用命令seinfo和sesearch，用于查看SELinux的角色用户类型等信息。

# 安装 #

CentOS下，setools-console缺省未安装，需要自行安装。

> 安装命令：yum install setools-console -y

[root@liumiaocn ~]# yum install setools-console -y
    Loaded plugins: fastestmirror
    ...省略
    Running transaction
      Installing : setools-libs-3.3.8-4.el7.x86_64                                                                                      1/2 
      Installing : setools-console-3.3.8-4.el7.x86_64                                                                                   2/2 
      Verifying  : setools-libs-3.3.8-4.el7.x86_64                                                                                      1/2 
      Verifying  : setools-console-3.3.8-4.el7.x86_64                                                                                   2/2 
    
    Installed:
      setools-console.x86_64 0:3.3.8-4.el7                                                                                                  
    
    Dependency Installed:
      setools-libs.x86_64 0:3.3.8-4.el7                                                                                                     
    
    Complete!
    [root@liumiaocn ~]#

# 示例 #

[root@liumiaocn ~]# ls -Z
    -rw-------. root root system_u:object_r:admin_home_t:s0 anaconda-ks.cfg
    [root@liumiaocn ~]#

# 查看用户 #

可以看到用户信息为system\_u，可以通过seinfo -u查看相关

[root@liumiaocn ~]# seinfo -u
    
    Users: 8
       sysadm_u
       system_u
       xguest_u
       root
       guest_u
       staff_u
       user_u
       unconfined_u
    [root@liumiaocn ~]#

# 查看角色 #

[root@liumiaocn ~]# seinfo -r
    
    Roles: 14
       auditadm_r
       dbadm_r
       guest_r
       staff_r
       user_r
       logadm_r
       object_r
       secadm_r
       sysadm_r
       system_r
       webadm_r
       xguest_r
       nx_server_r
       unconfined_r
    [root@liumiaocn ~]#

# 查看类型 #

[root@liumiaocn ~]# seinfo -t |head -n20
    
    Types: 4774
       bluetooth_conf_t
       cmirrord_exec_t
       colord_exec_t
       container_auth_t
       foghorn_exec_t
       jacorb_port_t
       pki_ra_exec_t
       pki_ra_lock_t
       sosreport_t
       squid_script_exec_t
       etc_runtime_t
       fenced_tmp_t
       git_session_t
       glance_port_t
       osad_log_t
       presence_port_t
       samba_secrets_t
       snort_exec_t
    [root@liumiaocn ~]#

# 查看规则 #

[root@liumiaocn ~]# seinfo -b |head -n20
    
    Conditional Booleans: 315
       auditadm_exec_content
       cdrecord_read_content
       cvs_read_shadow
       fcron_crond
       glance_api_can_network
       gluster_export_all_rw
       httpd_dontaudit_search_dirs
       httpd_manage_ipa
       httpd_run_ipa
       httpd_run_stickshift
       httpd_use_fusefs
       httpd_use_openstack
       mmap_low_allowed
       postgresql_selinux_transmit_client_label
       samba_share_fusefs
       selinuxuser_execstack
       selinuxuser_use_ssh_chroot
       staff_exec_content
    [root@liumiaocn ~]#

# 查看允许的规则（allow） #

[root@liumiaocn ~]# sesearch --allow |wc -l
    106709
    [root@liumiaocn ~]# sesearch --allow |head -n10
    Found 106707 semantic av rules:
       allow certwatch_t crond_t : fifo_file { ioctl read write getattr lock append open } ; 
       allow sssd_t ldap_client_packet_t : packet { send recv } ; 
       allow unconfined_service_t systemd_networkd_t : dbus send_msg ; 
       allow rhev_agentd_consolehelper_t sysfs_t : lnk_file { read getattr } ; 
       allow afs_kaserver_t selinux_config_t : lnk_file { read getattr } ; 
       allow pcp_pmie_t system_cronjob_t : process sigchld ; 
       allow postgresql_t etc_t : dir { ioctl read getattr lock search open } ; 
       allow sandbox_web_type vnc_port_t : tcp_socket name_connect ; 
       allow sblim_gatherd_t sblim_gatherd_t : sem { create destroy getattr setattr read write associate unix_read unix_write } ; 
    [root@liumiaocn ~]#

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpdW1pYW9jbg_size_16_color_FFFFFF_t_70_pic_center_pic_center]: /images/20221124/6e4ac97bfebf4899a2b04029ab565fd3.png