Skip to content

antony@notes:~/suse$ cat "在-SLES-12-SP5-安裝和設定-SELinux.md"

在 SLES 12 SP5 安裝和設定 SELinux

2024-03-01· suse

在 SLES 12 SP5 安裝和設定 SELinux

安裝 SELinux Packages 

$ sudo zypper in policycoreutils setools-console selinux-policy selinux-policy-devel setools-tcl mcstrans ruby-selinux selinux-doc selinux-policy-minimum setools-gui setools-java

啟動 SElinux

切換為 permissive mode

sudo sed -i "s|`cat /etc/selinux/config | grep '^SELINUX='`|SELINUX=permissive|g" /etc/selinux/config

切換為 enforce mode

sudo sed -i "s|`cat /etc/selinux/config | grep '^SELINUX='`|SELINUX=enforcing|g" /etc/selinux/config

設定 GRUB 開機選單

Application > System Tools > YaST > System › Boot Loader › Kernel Parameters.

將以下參數新增至可選的核心命令列參數：

security=selinux selinux=1 enforcing=0

image

重啟電腦

$ sudo reboot

觀察目前的 SELinux 模式 

$ getenforce

螢幕輸出 :

Permissive

顯示詳細的 SELinux 設定值 

$ sestatus

螢幕輸出 :

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             minimum
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      30

檢查目前的核心是否有 SELinux 的參數 

$ cat /proc/cmdline

螢幕輸出 :

BOOT_IMAGE=/boot/vmlinuz-4.12.14-120-default root=UUID=1f1bc5cf-d039-4291-a353-ad891228007c resume=/dev/sda1 splash=silent quiet showopts crashkernel=165M,high crashkernel=72M,low security=selinux selinux=1 enforcing=0 mitigations=auto

SELinux boolean 

$ sudo setsebool -P ssh_sysadm_login on

$ sudo semanage boolean -l | tail -n 4
ssh_sysadm_login               (on   ,   on)  Allow ssh to sysadm login
logging_syslogd_use_tty        (on   ,   on)  Allow logging to syslogd use tty
nfs_export_all_ro              (on   ,   on)  Allow nfs to export all ro
cron_can_relabel               (off  ,  off)  Allow cron to can relabel
SUSE Manager Basic OperationsCluster Managed Storage