SELinux：查看已安装的模块和优先级

清疚 2022-12-23 06:43 109阅读 0赞

参考链接：  
[https://blog.siphos.be/2014/10/using-multiple-priorities-with-modules/][https_blog.siphos.be_2014_10_using-multiple-priorities-with-modules]

[https://wiki.gentoo.org/wiki/SELinux/FAQ][https_wiki.gentoo.org_wiki_SELinux_FAQ]

--------------------

[adams@localhost ~]$ sudo semodule --list-modules=full
    400 local             pp         
    400 sshd              pp         
    200 container         pp         
    200 flatpak           pp         
    100 abrt              pp         
    100 accountsd         pp         
    100 acct              pp         
    100 afs               pp         
    100 aiccu             pp         
    100 aide              pp         
    100 ajaxterm          pp         
    100 alsa              pp         
    100 amanda            pp         
    100 amtu              pp         
    100 anaconda          pp         
    100 antivirus         pp         
    100 apache            pp         
    100 apcupsd           pp         
    100 apm               pp         
    100 application       pp         
    100 arpwatch          pp         
    100 asterisk          pp         
    100 auditadm          pp         
    100 authconfig        pp         
    100 authlogin         pp         
    100 automount         pp         
    100 avahi             pp         
    100 awstats           pp         
    100 bacula            pp         
    100 base              pp         
    100 bcfg2             pp         
    100 bind              pp         
    100 bitlbee           pp         
    100 blkmapd           pp         
    100 blueman           pp         
    100 bluetooth         pp         
    100 boinc             pp         
    100 boltd             pp         
    100 bootloader        pp         
    100 brctl             pp         
    100 brltty            pp         
    100 bugzilla          pp         
    100 bumblebee         pp         
    100 cachefilesd       pp         
    100 calamaris         pp         
    100 callweaver        pp         
    100 canna             pp         
    100 ccs               pp         
    100 cdrecord          pp         
    100 certmaster        pp         
    100 certmonger        pp         
    100 certwatch         pp         
    100 cfengine          pp         
    100 cgdcbxd           pp         
    100 cgroup            pp         
    100 chrome            pp         
    100 chronyd           pp         
    100 cinder            pp         
    100 cipe              pp         
    100 clock             pp         
    100 clogd             pp         
    100 cloudform         pp         
    100 cmirrord          pp         
    100 cobbler           pp         
    100 cockpit           pp         
    100 collectd          pp         
    100 colord            pp         
    100 comsat            pp         
    100 condor            pp         
    100 conman            pp         
    100 conntrackd        pp         
    100 consolekit        pp         
    100 couchdb           pp         
    100 courier           pp         
    100 cpucontrol        pp         
    100 cpufreqselector   pp         
    100 cpuplug           pp         
    100 cron              pp         
    100 ctdb              pp         
    100 cups              pp         
    100 cvs               pp         
    100 cyphesis          pp         
    100 cyrus             pp         
    100 daemontools       pp         
    100 dbadm             pp         
    100 dbskk             pp         
    100 dbus              pp         
    100 dcc               pp         
    100 ddclient          pp         
    100 denyhosts         pp         
    100 devicekit         pp         
    100 dhcp              pp         
    100 dictd             pp         
    100 dirsrv            pp         
    100 dirsrv-admin      pp         
    100 dmesg             pp         
    100 dmidecode         pp         
    100 dnsmasq           pp         
    100 dnssec            pp         
    100 dovecot           pp         
    100 drbd              pp         
    100 dspam             pp         
    100 entropyd          pp         
    100 exim              pp         
    100 fail2ban          pp         
    100 fcoe              pp         
    100 fetchmail         pp         
    100 finger            pp         
    100 firewalld         pp         
    100 firewallgui       pp         
    100 firstboot         pp         
    100 fprintd           pp         
    100 freeipmi          pp         
    100 freqset           pp         
    100 fstools           pp         
    100 ftp               pp         
    100 fwupd             pp         
    100 games             pp         
    100 gdomap            pp         
    100 geoclue           pp         
    100 getty             pp         
    100 git               pp         
    100 gitosis           pp         
    100 glance            pp         
    100 glusterd          pp         
    100 gnome             pp         
    100 gpg               pp         
    100 gpm               pp         
    100 gpsd              pp         
    100 gssproxy          pp         
    100 guest             pp         
    100 hddtemp           pp         
    100 hostapd           pp         
    100 hostname          pp         
    100 hsqldb            pp         
    100 hwloc             pp         
    100 hypervkvp         pp         
    100 ibacm             pp         
    100 icecast           pp         
    100 inetd             pp         
    100 init              pp         
    100 inn               pp         
    100 iodine            pp         
    100 iotop             pp         
    100 ipa               pp         
    100 ipmievd           pp         
    100 ipsec             pp         
    100 iptables          pp         
    100 irc               pp         
    100 irqbalance        pp         
    100 iscsi             pp         
    100 isns              pp         
    100 jabber            pp         
    100 jetty             pp         
    100 jockey            pp         
    100 journalctl        pp         
    100 kdbus             pp         
    100 kdump             pp         
    100 kdumpgui          pp         
    100 keepalived        pp         
    100 kerberos          pp         
    100 keyboardd         pp         
    100 keystone          pp         
    100 kismet            pp         
    100 kmscon            pp         
    100 kpatch            pp         
    100 ksmtuned          pp         
    100 ktalk             pp         
    100 l2tp              pp         
    100 ldap              pp         
    100 libraries         pp         
    100 likewise          pp         
    100 linuxptp          pp         
    100 lircd             pp         
    100 livecd            pp         
    100 lldpad            pp         
    100 loadkeys          pp         
    100 locallogin        pp         
    100 lockdev           pp         
    100 logadm            pp         
    100 logging           pp         
    100 logrotate         pp         
    100 logwatch          pp         
    100 lpd               pp         
    100 lsm               pp         
    100 lttng-tools       pp         
    100 lvm               pp         
    100 mailman           pp         
    100 mailscanner       pp         
    100 man2html          pp         
    100 mandb             pp         
    100 mcelog            pp         
    100 mediawiki         pp         
    100 memcached         pp         
    100 milter            pp         
    100 minidlna          pp         
    100 minissdpd         pp         
    100 mip6d             pp         
    100 mirrormanager     pp         
    100 miscfiles         pp         
    100 mock              pp         
    100 modemmanager      pp         
    100 modutils          pp         
    100 mojomojo          pp         
    100 mon_statd         pp         
    100 mongodb           pp         
    100 motion            pp         
    100 mount             pp         
    100 mozilla           pp         
    100 mpd               pp         
    100 mplayer           pp         
    100 mrtg              pp         
    100 mta               pp         
    100 munin             pp         
    100 mysql             pp         
    100 mythtv            pp         
    100 naemon            pp         
    100 nagios            pp         
    100 namespace         pp         
    100 ncftool           pp         
    100 netlabel          pp         
    100 netutils          pp         
    100 networkmanager    pp         
    100 ninfod            pp         
    100 nis               pp         
    100 nova              pp         
    100 nscd              pp         
    100 nsd               pp         
    100 nslcd             pp         
    100 ntop              pp         
    100 ntp               pp         
    100 numad             pp         
    100 nut               pp         
    100 nx                pp         
    100 obex              pp         
    100 oddjob            pp         
    100 opafm             pp         
    100 openct            pp         
    100 opendnssec        pp         
    100 openfortivpn      pp         
    100 openhpid          pp         
    100 openshift         pp         
    100 openshift-origin  pp         
    100 opensm            pp         
    100 openvpn           pp         
    100 openvswitch       pp         
    100 openwsman         pp         
    100 oracleasm         pp         
    100 osad              pp         
    100 pads              pp         
    100 passenger         pp         
    100 pcmcia            pp         
    100 pcp               pp         
    100 pcscd             pp         
    100 pdns              pp         
    100 pegasus           pp         
    100 permissivedomains cil         
    100 pesign            pp         
    100 pingd             pp         
    100 piranha           pp         
    100 pkcs              pp         
    100 pkcs11proxyd      pp         
    100 pki               pp         
    100 plymouthd         pp         
    100 podsleuth         pp         
    100 policykit         pp         
    100 polipo            pp         
    100 portmap           pp         
    100 portreserve       pp         
    100 postfix           pp         
    100 postgresql        pp         
    100 postgrey          pp         
    100 ppp               pp         
    100 prelink           pp         
    100 prelude           pp         
    100 privoxy           pp         
    100 procmail          pp         
    100 prosody           pp         
    100 psad              pp         
    100 ptchown           pp         
    100 publicfile        pp         
    100 pulseaudio        pp         
    100 puppet            pp         
    100 pwauth            pp         
    100 qmail             pp         
    100 qpid              pp         
    100 quantum           pp         
    100 quota             pp         
    100 rabbitmq          pp         
    100 radius            pp         
    100 radvd             pp         
    100 raid              pp         
    100 rasdaemon         pp         
    100 rdisc             pp         
    100 readahead         pp         
    100 realmd            pp         
    100 redis             pp         
    100 remotelogin       pp         
    100 rhcs              pp         
    100 rhev              pp         
    100 rhgb              pp         
    100 rhnsd             pp         
    100 rhsmcertd         pp         
    100 ricci             pp         
    100 rkhunter          pp         
    100 rkt               pp         
    100 rlogin            pp         
    100 rngd              pp         
    100 rolekit           pp         
    100 roundup           pp         
    100 rpc               pp         
    100 rpcbind           pp         
    100 rpm               pp         
    100 rrdcached         pp         
    100 rshd              pp         
    100 rssh              pp         
    100 rsync             pp         
    100 rtas              pp         
    100 rtkit             pp         
    100 rwho              pp         
    100 samba             pp         
    100 sambagui          pp         
    100 sandbox           pp         
    100 sandboxX          pp         
    100 sanlock           pp         
    100 sasl              pp         
    100 sbd               pp         
    100 sblim             pp         
    100 screen            pp         
    100 secadm            pp         
    100 sectoolm          pp         
    100 selinuxutil       pp         
    100 sendmail          pp         
    100 sensord           pp         
    100 setrans           pp         
    100 setroubleshoot    pp         
    100 seunshare         pp         
    100 sge               pp         
    100 shorewall         pp         
    100 slocate           pp         
    100 slpd              pp         
    100 smartmon          pp         
    100 smokeping         pp         
    100 smoltclient       pp         
    100 smsd              pp         
    100 snapper           pp         
    100 snmp              pp         
    100 snort             pp         
    100 sosreport         pp         
    100 soundserver       pp         
    100 spamassassin      pp         
    100 speech-dispatcher pp         
    100 squid             pp         
    100 ssh               pp         
    100 sslh              pp         
    100 sssd              pp         
    100 staff             pp         
    100 stapserver        pp         
    100 stratisd          pp         
    100 stunnel           pp         
    100 su                pp         
    100 sudo              pp         
    100 svnserve          pp         
    100 swift             pp         
    100 sysadm            pp         
    100 sysadm_secadm     pp         
    100 sysnetwork        pp         
    100 sysstat           pp         
    100 systemd           pp         
    100 tangd             pp         
    100 targetd           pp         
    100 tcpd              pp         
    100 tcsd              pp         
    100 telepathy         pp         
    100 telnet            pp         
    100 tftp              pp         
    100 tgtd              pp         
    100 thin              pp         
    100 thumb             pp         
    100 timedatex         pp         
    100 tlp               pp         
    100 tmpreaper         pp         
    100 tomcat            pp         
    100 tor               pp         
    100 tuned             pp         
    100 tvtime            pp         
    100 udev              pp         
    100 ulogd             pp         
    100 uml               pp         
    100 unconfined        pp         
    100 unconfineduser    pp         
    100 unlabelednet      pp         
    100 unprivuser        pp         
    100 updfstab          pp         
    100 usbmodules        pp         
    100 usbmuxd           pp         
    100 userdomain        pp         
    100 userhelper        pp         
    100 usermanage        pp         
    100 usernetctl        pp         
    100 uucp              pp         
    100 uuidd             pp         
    100 varnishd          pp         
    100 vdagent           pp         
    100 vhostmd           pp         
    100 virt              pp         
    100 vlock             pp         
    100 vmtools           pp         
    100 vmware            pp         
    100 vnstatd           pp         
    100 vpn               pp         
    100 w3c               pp         
    100 watchdog          pp         
    100 wdmd              pp         
    100 webadm            pp         
    100 webalizer         pp         
    100 wine              pp         
    100 wireshark         pp         
    100 xen               pp         
    100 xguest            pp         
    100 xserver           pp         
    100 zabbix            pp         
    100 zarafa            pp         
    100 zebra             pp         
    100 zoneminder        pp         
    100 zosremote         pp         
    [adams@localhost ~]$

查看所有模块是`full`，不是`all`。 `semodule`命令的帮助信息如下：

[adams@localhost ~]$ semodule --help
    usage:  semodule [option]... MODE...
    Manage SELinux policy modules.
    MODES:
      -R, --reload		    reload policy
      -B, --build		    build and reload policy
      -D,--disable_dontaudit    Remove dontaudits from policy
      -i,--install=MODULE_PKG   install a new module
      -r,--remove=MODULE_NAME   remove existing module at desired priority
      -l[KIND],--list-modules[=KIND]  display list of installed modules
         KIND:  standard  list highest priority, enabled modules
                full      list all modules
      -X,--priority=PRIORITY    set priority for following operations (1-999)
      -e,--enable=MODULE_NAME   enable module
      -d,--disable=MODULE_NAME  disable module
      -E,--extract=MODULE_NAME  extract module
    Options:
      -s,--store	   name of the store to operate on
      -N,-n,--noreload do not reload policy after commit
      -h,--help        print this message and quit
      -v,--verbose     be verbose
      -P,--preserve_tunables	Preserve tunables in policy
      -C,--ignore-module-cache	Rebuild CIL modules compiled from HLL files
      -p,--path        use an alternate path for the policy root
      -S,--store-path  use an alternate path for the policy store root
      -c, --cil extract module as cil. This only affects module extraction.
      -H, --hll extract module as hll. This only affects module extraction.
    [adams@localhost ~]$

[https_blog.siphos.be_2014_10_using-multiple-priorities-with-modules]: https://blog.siphos.be/2014/10/using-multiple-priorities-with-modules/
[https_wiki.gentoo.org_wiki_SELinux_FAQ]: https://wiki.gentoo.org/wiki/SELinux/FAQ