SELinux学习：label相关

系统管理员 2023-01-02 02:23 118阅读 0赞

参考链接：  
[SELinux 安全策略解析][SELinux]

[Understanding SELinux File Labelling and SELinux Context][]

[Practical SELinux for the beginner: Contexts and labels][Practical SELinux for the beginner_ Contexts and labels]

[Security-Enhanced Linux][]

[SELinux/Labels][SELinux_Labels]

[SELinux/EnforcePolicy][SELinux_EnforcePolicy]

[SELinux AVC denies at boot][]

[SELinux 及 permision denied 问题][SELinux _ permision denied]

[SELinux/Tutorials/How does a process get into a certain context][SELinux_Tutorials_How does a process get into a certain context]

[unlabeled\_t type][unlabeled_t type]

[Fedora Core5 SELinux FAQ][]

[SELinux - Relabeling\_Files][SELinux - Relabeling_Files]

[How logins get their SELinux user context][]

[Fedora 13-Security-Enhanced\_Linux/][Fedora 13-Security-Enhanced_Linux]

[Your visual how-to guide for SELinux policy enforcement][]

[SELinux概览][SELinux 1]

[SELinux 初始化][SELinux 2]

[libselinux 2.3 Library Functions][]

[HowTos/SELinux][HowTos_SELinux]

[Policy Role in Boot][]

[SELinux Boot Process][]

[A sysadmin’s guide to SELinux: 42 answers to the big questions][A sysadmin_s guide to SELinux_ 42 answers to the big questions]

--------------------

想要使`selinux`从关闭到开启后，可以重新打标签，需要 `selinux-autorelabel-mark.service` 服务处于开启状态：

[adams@localhost ~]$ systemctl  status selinux-autorelabel-mark.service 
    ● selinux-autorelabel-mark.service - Mark the need to relabel after reboot
       Loaded: loaded (/usr/lib/systemd/system/selinux-autorelabel-mark.service; enabled; vendor preset: enabled)
       Active: inactive (dead)
    [adams@localhost ~]$

该服务文件：

[adams@localhost ~]$ cat /usr/lib/systemd/system/selinux-autorelabel-mark.service
    [Unit]
    Description=Mark the need to relabel after reboot
    DefaultDependencies=no
    Requires=local-fs.target
    Conflicts=shutdown.target
    After=local-fs.target
    Before=sysinit.target shutdown.target
    ConditionSecurity=!selinux
    ConditionPathIsDirectory=/etc/selinux
    ConditionPathExists=!/.autorelabel
    
    [Service]
    ExecStart=-/bin/touch /.autorelabel
    Type=oneshot
    RemainAfterExit=yes
    
    [Install]
    WantedBy=sysinit.target
    [adams@localhost ~]$

低版本linux，查看 ：`rhel-autorelabel-mark.service` 服务。

--------------------

软件包：setools-console
    工具： seinfo -t

软件包：setroubleshoot setroubleshoot-server
    工具：sealert -a /var/log/audit/audit.log > ~/myfile.txt

[SELinux]: http://kernel.meizu.com/linux-selinux-intro.html
[Understanding SELinux File Labelling and SELinux Context]: https://www.thegeekdiary.com/understanding-selinux-file-labelling-and-selinux-context/
[Practical SELinux for the beginner_ Contexts and labels]: https://www.techrepublic.com/blog/linux-and-open-source/practical-selinux-for-the-beginner-contexts-and-labels/
[Security-Enhanced Linux]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-working_with_selinux-selinux_contexts_labeling_files
[SELinux_Labels]: https://wiki.gentoo.org/wiki/SELinux/Labels
[SELinux_EnforcePolicy]: https://fedoraproject.org/wiki/SELinux/EnforcePolicy
[SELinux AVC denies at boot]: https://serverfault.com/questions/369144/selinux-avc-denies-at-boot
[SELinux _ permision denied]: https://blog.csdn.net/weixin_42915431/article/details/106533610
[SELinux_Tutorials_How does a process get into a certain context]: https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context
[unlabeled_t type]: https://danwalsh.livejournal.com/80570.html
[Fedora Core5 SELinux FAQ]: https://docs.fedoraproject.org/en-US/Fedora_Core/5/html/SELinux_FAQ/index.html
[SELinux - Relabeling_Files]: https://wiki.centos.org/HowTos/SELinux#Relabeling_Files
[How logins get their SELinux user context]: https://blog.siphos.be/2013/04/how-logins-get-their-selinux-user-context/
[Fedora 13-Security-Enhanced_Linux]: https://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/
[Your visual how-to guide for SELinux policy enforcement]: https://opensource.com/business/13/11/selinux-policy-guide
[SELinux 1]: https://blog.51cto.com/linuxtro/274909
[SELinux 2]: https://largeriver.gitbooks.io/selinux-linux-lsm/content/07_Initialization.html
[libselinux 2.3 Library Functions]: https://selinuxproject.org/page/LibselinuxAPISummary
[HowTos_SELinux]: https://wiki.centos.org/HowTos/SELinux
[Policy Role in Boot]: https://mirrors.tripadvisor.com/centos-vault/4.0/docs/html/rhel-selg-en-4/rhlcommon-section-0016.html
[SELinux Boot Process]: https://blog.calsoftinc.com/blog-page
[A sysadmin_s guide to SELinux_ 42 answers to the big questions]: https://opensource.com/article/18/7/sysadmin-guide-selinux